Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2007-6015

Published: 13/12/2007 Updated: 30/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 935
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Samba

Vulnerability Summary

Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 up to and including 3.0.27a, when the "domain logons" option is enabled, allows remote malicious users to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.

Vulnerable Product Search on Vulmon Subscribe to Product

samba samba 2.0.1

samba samba 2.0.7

samba samba 2.0.8

samba samba 2.2.3

samba samba 2.2.3a

samba samba 2.2.8a

samba samba 2.2.9

samba samba 3.0.13

samba samba 3.0.14

samba samba 3.0.21b

samba samba 3.0.21c

samba samba 3.0.25

samba samba 3.0.25c

samba samba 3.0.26

samba samba 2.0.3

samba samba 2.0.4

samba samba 2.2.0a

samba samba 2.2.11

samba samba 2.2.6

samba samba 2.2.7

samba samba 3.0.1

samba samba 3.0.10

samba samba 3.0.20

samba samba 3.0.20a

samba samba 3.0.20b

samba samba 3.0.23b

samba samba 3.0.23c

samba samba 2.0.10

samba samba 2.0.2

samba samba 2.0.9

samba samba 2.2.0

samba samba 2.2.4

samba samba 2.2.5

samba samba 3.0.0

samba samba 3.0.14a

samba samba 3.0.2

samba samba 3.0.22

samba samba 3.0.23a

samba samba 3.0.26a

samba samba 3.0.27

samba samba 3.0.2a

samba samba 2.0.5

samba samba 2.0.6

samba samba 2.2.12

samba samba 2.2.1a

samba samba 2.2.2

samba samba 2.2.7a

samba samba 2.2.8

samba samba 3.0.11

samba samba 3.0.12

samba samba 3.0.21

samba samba 3.0.21a

samba samba 3.0.23d

samba samba 3.0.24

samba samba 3.0.25a

samba samba 3.0.25b

Vendor Advisories

Ubuntu Security Notice: samba vulnerability
Alin Rad Pop discovered that Samba did not correctly check the size of reply packets to mailslot requests If a server was configured with domain logon enabled, an unauthenticated remote attacker could send a specially crafted domain logon packet and execute arbitrary code or crash the Samba service By default, domain logon is disabled in Ubuntu ...
Debian Security Advisories: DSA-1427-1 samba -- buffer overflow
Alin Rad Pop discovered that Samba, a LanManager-like file and printer server for Unix, is vulnerable to a buffer overflow in the nmbd code which handles GETDC mailslot requests, which might lead to the execution of arbitrary code For the old stable distribution (sarge), this problem has been fixed in version 3014a-3sarge11 Packages for m68k ...

Exploits

Exploit DB: Samba 3.0.27a - 'send_mailslot()' Remote Buffer Overflow
/* secuniacom/secunia_research/2007-99/advisory/ * * A remote attacker could send a specially crafted "SAMLOGON" domain * logon packet, possibly leading to the execution of arbitrary code with * elevated privileges Note that this vulnerability is exploitable only * when domain logon support is enabled in Samba * * /////// * * Sam ...

References

CWE-119http://secunia.com/secunia_research/2007-99/advisory/http://www.samba.org/samba/security/CVE-2007-6015.htmlhttp://www.redhat.com/support/errata/RHSA-2007-1114.htmlhttp://www.securityfocus.com/bid/26791http://secunia.com/advisories/27760http://bugs.gentoo.org/show_bug.cgi?id=200773http://support.avaya.com/elmodocs2/security/ASA-2007-520.htmhttps://issues.rpath.com/browse/RPL-1976https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00304.htmlhttps://www.redhat.com/archives/fedora-package-announce/2007-December/msg00308.htmlhttp://security.gentoo.org/glsa/glsa-200712-10.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:244http://www.redhat.com/support/errata/RHSA-2007-1117.htmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.451554http://www.novell.com/linux/security/advisories/2007_68_samba.htmlhttp://www.ubuntu.com/usn/usn-556-1http://www.securitytracker.com/id?1019065http://secunia.com/advisories/27894http://secunia.com/advisories/27977http://secunia.com/advisories/27993http://secunia.com/advisories/27999http://secunia.com/advisories/28003http://secunia.com/advisories/28028http://secunia.com/advisories/28029http://secunia.com/advisories/28067http://secunia.com/advisories/28089http://secunia.com/advisories/28037http://lists.apple.com/archives/security-announce/2008/Feb/msg00002.htmlhttp://www.us-cert.gov/cas/techalerts/TA08-043B.htmlhttp://secunia.com/advisories/28891http://lists.vmware.com/pipermail/security-announce/2008/000005.htmlhttp://www.kb.cert.org/vuls/id/438395http://secunia.com/advisories/29032http://secunia.com/advisories/29341http://securityreason.com/securityalert/3438http://sunsolve.sun.com/search/document.do?assetkey=1-26-238251-1http://secunia.com/advisories/30484http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01475657http://secunia.com/advisories/30835http://sunsolve.sun.com/search/document.do?assetkey=1-77-1019295.1-1http://www.vupen.com/english/advisories/2008/0859/referenceshttp://www.vupen.com/english/advisories/2008/0495/referenceshttp://marc.info/?l=bugtraq&m=120524782005154&w=2http://www.vupen.com/english/advisories/2008/1908http://www.vupen.com/english/advisories/2007/4153http://www.vupen.com/english/advisories/2008/0637http://www.vupen.com/english/advisories/2008/1712/referenceshttp://docs.info.apple.com/article.html?artnum=307430http://www.debian.org/security/2007/dsa-1427https://exchange.xforce.ibmcloud.com/vulnerabilities/38965https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5605https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11572http://www.securityfocus.com/archive/1/488457/100/0/threadedhttp://www.securityfocus.com/archive/1/485144/100/0/threadedhttp://www.securityfocus.com/archive/1/484827/100/0/threadedhttp://www.securityfocus.com/archive/1/484825/100/0/threadedhttp://www.securityfocus.com/archive/1/484818/100/0/threadedhttps://usn.ubuntu.com/556-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/4732/https://www.kb.cert.org/vuls/id/438395
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
hardcodedarbitrary codeCVE-2024-2404CVE-2024-21111CVE-2024-28627CVE-2024-4073information disclosureCVE-2024-32780CVE-2024-4040
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook