Published: 16/11/2007 Updated: 30/10/2018

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Stack-based buffer overflow in nmbd in Samba 3.0.0 up to and including 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote malicious users to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba samba 3.0.11
samba samba 3.0.12
samba samba 3.0.18
samba samba 3.0.19
samba samba 3.0.21c
samba samba 3.0.22
samba samba 3.0.25
samba samba 3.0.25c
samba samba 3.0.26
samba samba 3.0.26a
samba samba 3.0.7
samba samba 3.0.8
samba samba 3.0.0
samba samba 3.0.14a
samba samba 3.0.15
samba samba 3.0.20b
samba samba 3.0.21
samba samba 3.0.23b
samba samba 3.0.23c
samba samba 3.0.4
samba samba 3.0.1
samba samba 3.0.10
samba samba 3.0.16
samba samba 3.0.17
samba samba 3.0.21a
samba samba 3.0.21b
samba samba 3.0.23d
samba samba 3.0.24
samba samba 3.0.25a
samba samba 3.0.25b
samba samba 3.0.5
samba samba 3.0.6
samba samba 3.0.13
samba samba 3.0.14
samba samba 3.0.2
samba samba 3.0.20
samba samba 3.0.20a
samba samba 3.0.23
samba samba 3.0.23a
samba samba 3.0.2a
samba samba 3.0.3
samba samba 3.0.9

Debian Bug report logs - #451385 CVE-2007-5398 remote code execution via NetBIOS replies Package: samba; Maintainer for samba is Debian Samba Maintainers <pkg-samba-maint@listsaliothdebianorg>; Source for samba is src:samba (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: Thu, 15 Nov 2007 15:5 ...

Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests When samba is configured as a Primary or Backup Domain Controller, a remote attacker could send malicious logon requests and possibly cause a denial of service (CVE-2007-4572) ...

USN-544-1 fixed two vulnerabilities in Samba Fixes for CVE-2007-5398 are unchanged, but the upstream changes for CVE-2007-4572 introduced a regression in all releases which caused Linux smbfs mounts to fail Additionally, Dapper and Edgy included an incomplete patch which caused configurations using NetBIOS to fail A proper fix for these regressi ...

USN-617-1 fixed vulnerabilities in Samba The upstream patch introduced a regression where under certain circumstances accessing large files might cause the client to report an invalid packet length error This update fixes the problem ...

CWE-119 http://us1.samba.org/samba/security/CVE-2007-4572.html http://secunia.com/advisories/27450 https://issues.rpath.com/browse/RPL-1894 http://www.debian.org/security/2007/dsa-1409 https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00472.html http://www.gentoo.org/security/en/glsa/glsa-200711-29.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:224 http://www.redhat.com/support/errata/RHSA-2007-1013.html http://www.redhat.com/support/errata/RHSA-2007-1016.html http://www.redhat.com/support/errata/RHSA-2007-1017.html http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.447739 http://www.novell.com/linux/security/advisories/2007_65_samba.html http://www.ubuntu.com/usn/usn-544-2 http://www.securityfocus.com/bid/26454 http://securitytracker.com/id?1018954 http://secunia.com/advisories/27679 http://secunia.com/advisories/27682 http://secunia.com/advisories/27691 http://secunia.com/advisories/27701 http://secunia.com/advisories/27720 http://secunia.com/advisories/27731 http://secunia.com/advisories/27787 http://secunia.com/advisories/27927 http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html http://www.us-cert.gov/cas/techalerts/TA07-352A.html http://secunia.com/advisories/28136 http://lists.vmware.com/pipermail/security-announce/2008/000002.html http://secunia.com/advisories/28368 http://www.vmware.com/security/advisories/VMSA-2008-0001.html http://secunia.com/advisories/29341 http://secunia.com/advisories/30484 http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01475657 http://secunia.com/advisories/30736 http://www.ubuntu.com/usn/usn-617-1 http://secunia.com/advisories/30835 http://sunsolve.sun.com/search/document.do?assetkey=1-26-237764-1 http://www.vupen.com/english/advisories/2007/4238 http://www.vupen.com/english/advisories/2008/0859/references http://www.vupen.com/english/advisories/2008/0064 http://marc.info/?l=bugtraq&m=120524782005154&w=2 http://www.vupen.com/english/advisories/2008/1908 http://www.vupen.com/english/advisories/2007/3869 http://www.vupen.com/english/advisories/2008/1712/references http://docs.info.apple.com/article.html?artnum=307179 https://exchange.xforce.ibmcloud.com/vulnerabilities/38501 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5643 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11132 https://usn.ubuntu.com/544-1/http://www.securityfocus.com/archive/1/486859/100/0/threaded http://www.securityfocus.com/archive/1/485936/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=451385 https://nvd.nist.gov https://usn.ubuntu.com/544-1/

CVE-2007-4572

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect