10
CVSSv2

CVE-2012-1182

Published: 10/04/2012 Updated: 30/10/2018
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
VMScore: 1000
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

The RPC code generator in Samba 3.x prior to 3.4.16, 3.5.x prior to 3.5.14, and 3.6.x prior to 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote malicious users to execute arbitrary code via a crafted RPC call.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

samba samba 3.4.0

samba samba 3.4.14

samba samba 3.4.5

samba samba 3.4.6

samba samba 3.3.15

samba samba 3.3.16

samba samba 3.3.5

samba samba 3.3.4

samba samba 3.3.3

samba samba 3.2.4

samba samba 3.2.3

samba samba 3.2.11

samba samba 3.2.12

samba samba 3.0.14

samba samba 3.0.29

samba samba 3.0.1

samba samba 3.0.0

samba samba 3.0.23b

samba samba 3.0.23c

samba samba 3.0.21

samba samba 3.0.21a

samba samba 3.0.6

samba samba 3.0.2a

samba samba 3.0.25a

samba samba 3.0.4

samba samba 3.0.23

samba samba 3.0.26

samba samba 3.0.20

samba samba 3.0.25

samba samba 3.4.3

samba samba 3.4.4

samba samba 3.4.11

samba samba 3.4.8

samba samba 3.3.7

samba samba 3.3.8

samba samba 3.3.14

samba samba 3.3.2

samba samba 3.2.15

samba samba 3.2.13

samba samba 3.2.9

samba samba 3.2.1

samba samba 3.0.37

samba samba 3.0.27

samba samba 3.0.18

samba samba 3.0.17

samba samba 3.0.13

samba samba 3.0.12

samba samba 3.0.22

samba samba 3.0.9

samba samba 3.0.5

samba samba 3.0.25c

samba samba 3.0.31

samba samba 3.0.26a

samba samba 3.0.28

samba samba

samba samba 3.4.13

samba samba 3.4.12

samba samba 3.4.7

samba samba 3.3.9

samba samba 3.3.10

samba samba 3.3.12

samba samba 3.3.13

samba samba 3.2.0

samba samba 3.2.14

samba samba 3.2.7

samba samba 3.2.2

samba samba 3.1.0

samba samba 3.0.16

samba samba 3.0.15

samba samba 3.0.11

samba samba 3.0.10

samba samba 3.0.23d

samba samba 3.0.24

samba samba 3.0.21b

samba samba 3.0.21c

samba samba 3.0.25b

samba samba 3.0.3

samba samba 3.0.32

samba samba 3.0.33

samba samba 3.0.2

samba samba 3.4.1

samba samba 3.4.2

samba samba 3.4.10

samba samba 3.4.9

samba samba 3.3.0

samba samba 3.3.6

samba samba 3.3.1

samba samba 3.3.11

samba samba 3.2.6

samba samba 3.2.5

samba samba 3.2.8

samba samba 3.2.10

samba samba 3.0.35

samba samba 3.0.36

samba samba 3.0.14a

samba samba 3.0.19

samba samba 3.0.23a

samba samba 3.0.20a

samba samba 3.0.20b

samba samba 3.0.8

samba samba 3.0.7

samba samba 3.0.34

samba samba 3.0.30

samba samba 3.5.4

samba samba 3.5.5

samba samba 3.5.12

samba samba 3.5.13

samba samba 3.5.0

samba samba 3.5.1

samba samba 3.5.8

samba samba 3.5.9

samba samba 3.5.6

samba samba 3.5.7

samba samba 3.5.2

samba samba 3.5.3

samba samba 3.5.10

samba samba 3.5.11

samba samba 3.6.1

samba samba 3.6.2

samba samba 3.6.0

samba samba 3.6.3

Vendor Advisories

Debian Bug report logs - #668309 samba: remote code execution (CVE-2012-1182) Package: src:samba; Maintainer for src:samba is Debian Samba Maintainers <pkg-samba-maint@listsaliothdebianorg>; Reported by: Yves-Alexis Perez <corsac@debianorg> Date: Tue, 10 Apr 2012 20:54:45 UTC Severity: critical Tags: security Fo ...
Samba could be made to run programs as the administrator if it received specially crafted network traffic ...
Synopsis Critical: samba security update Type/Severity Security Advisory: Critical Topic Updated samba packages that fix one security issue are now available forRed Hat Enterprise Linux 5 and 6; Red Hat Enterprise Linux 53 Long Life;and Red Hat Enterprise Linux 56, 60 and 61 Extended Update SupportThe ...
Synopsis Moderate: samba4 security, bug fix and enhancement update Type/Severity Security Advisory: Moderate Topic Updated samba4 packages that fix one security issue, multiple bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated thi ...
Synopsis Moderate: openchange security, bug fix and enhancement update Type/Severity Security Advisory: Moderate Topic Updated openchange packages that fix one security issue, several bugs, andadd various enhancements are now available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has ra ...
Synopsis Critical: samba security update Type/Severity Security Advisory: Critical Topic Updated samba packages that fix one security issue are now available forRed Hat Enterprise Linux 4 Extended Life Cycle SupportThe Red Hat Security Response Team has rated this update as having criticalsecurity impact ...
Synopsis Critical: samba3x security update Type/Severity Security Advisory: Critical Topic Updated samba3x packages that fix one security issue are now available forRed Hat Enterprise Linux 5 and Red Hat Enterprise Linux 56 Extended UpdateSupportThe Red Hat Security Response Team has rated this update as ...
It was discovered that Samba, the SMB/CIFS file, print, and login server, contained a flaw in the remote procedure call (RPC) code which allowed remote code execution as the super user from an unauthenticated connection For the stable distribution (squeeze), this problem has been fixed in version 2:356~dfsg-3squeeze7 For the testing distributio ...

Exploits

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit: ...

Nmap Scripts

samba-vuln-cve-2012-1182

Checks if target machines are vulnerable to the Samba heap overflow vulnerability CVE-2012-1182.

nmap --script=samba-vuln-cve-2012-1182  -p 139 <target>

PORT STATE SERVICE 139/tcp open netbios-ssn Host script results: | samba-vuln-cve-2012-1182: | VULNERABLE: | SAMBA remote heap overflow | State: VULNERABLE | IDs: CVE:CVE-2012-1182 | Risk factor: HIGH CVSSv2: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C) | Description: | Samba versions 3.6.3 and all versions previous to this are affected by | a vulnerability that allows remote code execution as the "root" user | from an anonymous connection. | | Disclosure date: 2012-03-15 | References: | http://www.samba.org/samba/security/CVE-2012-1182 |_ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1182
samba-vuln-cve-2012-1182

Checks if target machines are vulnerable to the Samba heap overflow vulnerability CVE-2012-1182.

nmap --script=samba-vuln-cve-2012-1182  -p 139 <target>

PORT STATE SERVICE 139/tcp open netbios-ssn Host script results: | samba-vuln-cve-2012-1182: | VULNERABLE: | SAMBA remote heap overflow | State: VULNERABLE | IDs: CVE:CVE-2012-1182 | Risk factor: HIGH CVSSv2: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C) | Description: | Samba versions 3.6.3 and all versions previous to this are affected by | a vulnerability that allows remote code execution as the "root" user | from an anonymous connection. | | Disclosure date: 2012-03-15 | References: | http://www.samba.org/samba/security/CVE-2012-1182 |_ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1182

Github Repositories

python-nmap IP taramak istiyorsaniz 1: aginiza bagli ipler icin 2: ms17-010 taramasi icin 3: Zaafiyet taramasi icin 4: ip adresinizi giriniz : 192168100166 Starting Nmap 770 ( nmaporg ) at 2018-12-13 17:57 T³rkiye Standart Saati Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 22400251 | After NULL UDP avahi packet

Information Collection For Pentest SRC 声明 Author:Qftm Data:2020/01/18 ProjectAddress:githubcom/Qftm/Information_Collection_Handbook GitbookAddress:qftmgithubio/Information_Collection_Handbook/ 正文 "只有不努力的黑客,没有攻不破的系统"。 在SRC漏洞挖掘或渗透测试中

week16 Week 16 Homework Submission File: Penetration Testing 1 Step 1: Google Dorking Using Google, can you identify who the Chief Executive Officer of Altoro Mutual is: Karl Fitzgerald How can this information be helpful to an attacker: Definitely during recon for social engineering, phishing Step 2: DNS and Domain Discovery Enter the IP address for demotestfirene

Week 16 Homework Submission File: Penetration Testing 1 Step 1: Google Dorking Using Google, can you identify who the Chief Executive Officer of Altoro Mutual is: Ans :- Use the command site:demotestfirenet intext:chief executive officer How can this information be helpful to an attacker: Ans :- This information would serve as OSINT and can be used as by an attacker for

THM-Blue 3/1/2022 | Yash Mhaskar Nmap 791 scan initiated Sun Feb 27 16:45:34 2022 as: nmap -A -T4 -sV --script vuln -oN nmaptxt 1010188114 Nmap scan report for 1010188114 Host is up (018s latency) Not shown: 991 closed ports PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-s

Audit and pentest methodologies for Windows including internal enumeration, privesc, lateral movement, etc.

Windows Privilege Esclations Table of contents ➤ Internal Enumeration 0 Display hidden forlder 1 Manual enumeration 3 Automated tools 4 Bloodhound ➤ Password harvesting 1 Automated search (Seatbelt) 1 Automated search (Lazagne) 2 Search passwords in files 3 Search in usual Windows files 4 Search in Powershell history 5 Search in Windows credential manager 6 Se

Hack into a Mr. Robot themed Windows machine. Use metasploit for initial access, utilise powershell for Windows privilege escalation enumeration and learn a new technique to get Administrator access.

Steel Mountain tryhackmecom/room/steelmountain Hack into a Mr Robot themed Windows machine Use metasploit for initial access, utilise powershell for Windows privilege escalation enumeration and learn a new technique to get Administrator access F3d3r!c0 | Nov 20th, 2020 [Task 1] Introduction In this room you will enumerate a Windows machine, gain initial access with

Week 16 Homework Submission File: Penetration Testing 1 Step 1: Google Dorking Using Google, can you identify who the Chief Executive Officer of Altoro Mutual is: site:altoromutualcom intext:Chief Executive Officer Karl Fitzgerald is the Chief Executive Officer How can this information be helpful to an attacker: The google dorking techniques help find potential targets al

Blue Notes on tryhackme ctf A number of unnecessary steps were added for learning Actually gaining system level access is a short task recon nmap └─# nmap -sV -vv --script vuln 1010204243 PORT STATE SERVICE REASON VERSION 135/tcp open msrpc syn-ack ttl 128 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 128 Microsoft Windows

Just another set of commands for pentesting

[OSCP Reference] Port Scanning #SYN Scan with default Script Scan, Skip host discovery with the fastest timing: nmap -sC -sS -Pn -T5 -p T:1-65535,U:1-65535 192168017 &gt; scan #Fastest Scan for ever: nmap -sS -Pn -T5 192168017 &gt; scan #Ping Scan: nmap -v -sn 10000/8 #Some other pretty useful nmap -sC -sV -p- -oA nmap/all 10101010 nmap -sU -vv -oA nm

Information Collection For Pentest SRC 声明 Author:Qftm Data:2020/01/18 ProjectAddress:githubcom/Qftm/Information_Collection_Handbook GitbookAddress:qftmgithubio/Information_Collection_Handbook/ 正文 "只有不努力的黑客,没有攻不破的系统"。 在SRC漏洞挖掘或渗透测试中

Handbook of information collection for penetration testing and src

Information Collection For Pentest SRC 声明 Author:Qftm Data:2020/01/18 ProjectAddress:githubcom/Qftm/Information_Collection_Handbook GitbookAddress:qftmgithubio/Information_Collection_Handbook/ 正文 "只有不努力的黑客,没有攻不破的系统"。 在SRC漏洞挖掘或渗透测试中

Penetration-Testing-1 Step 1: Google Dorking Using Google, can you identify who the Chief Executive Officer of Altoro Mutual is: Karl Fitzgerald How can this information be helpful to an attacker: This could cause phishing attempts Businesses normally have public information available online about the CEO and other higher contributors in their company Step 2: DNS and Doma

rt-n56u ASUS RT-N11P/N14U/N56U/N65U/AC51U/AC54U/AC1200HP custom firmware 3X39-095 by Padavan Project sources: git clone codegooglecom/p/rt-n56u/ Git HTTP frontend: codegooglecom/p/rt-n56u/source/list ATTENTION: After the first upgrade from official firmware, all settings will be erased Do not load settings (CFG fil

blue tryhackme writeup

so boom we start the machine first thing i do is recon I hit the terminal and start the nmap scan and it throws this up Root@ip-10-10-183-64:~# nmap 101063243 Starting Nmap 760 ( nmaporg ) at 2023-10-25 17:19 BST Nmap scan report for ip-10-10-63-243eu-west-1computeinternal (101063243) Host is up (000047s latency) Not shown: 991 closed ports PORT STATE

References

CWE-189https://www.samba.org/samba/security/CVE-2012-1182http://support.apple.com/kb/HT5281http://lists.apple.com/archives/security-announce/2012/May/msg00001.htmlhttp://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578http://secunia.com/advisories/48999http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080567.htmlhttp://www.ubuntu.com/usn/USN-1423-1http://secunia.com/advisories/48844http://secunia.com/advisories/48879http://secunia.com/advisories/48816http://secunia.com/advisories/48818http://secunia.com/advisories/48754http://secunia.com/advisories/48751http://secunia.com/advisories/48873http://marc.info/?l=bugtraq&m=134323086902585&w=2http://marc.info/?l=bugtraq&m=133951282306605&w=2http://www.securitytracker.com/id?1026913http://www.samba.org/samba/history/samba-3.6.4.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/078836.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/078726.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/078258.htmlhttp://www.debian.org/security/2012/dsa-2450http://www.mandriva.com/security/advisories?name=MDVSA-2012:055http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-04/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-04/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-04/msg00007.htmlhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668309https://usn.ubuntu.com/1423-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/21850/