Published: 24/02/2015 Updated: 13/02/2023

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x prior to 3.6.25, 4.0.x prior to 4.0.25, 4.1.x prior to 4.1.17, and 4.2.x prior to 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote malicious users to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux 7.0
redhat enterprise linux 6.0
redhat enterprise linux 5
samba samba 4.1.9
samba samba 3.6.24
samba samba 4.0.14
samba samba 3.6.17
samba samba 4.0.24
samba samba 3.5.1
samba samba 4.1.16
samba samba 4.1.12
samba samba 4.0.2
samba samba 4.2.0
samba samba 3.5.9
samba samba 4.1.14
samba samba 3.6.10
samba samba 3.5.7
samba samba 4.0.22
samba samba 4.0.11
samba samba 4.1.7
samba samba 4.0.3
samba samba 3.5.11
samba samba 4.0.21
samba samba 4.0.16
samba samba 4.1.8
samba samba 3.6.23
samba samba 4.0.13
samba samba 4.1.5
samba samba 4.1.6
samba samba 4.0.17
samba samba 3.5.6
samba samba 4.0.6
samba samba 4.0.19
samba samba 3.6.11
samba samba 3.6.19
samba samba 3.6.16
samba samba 3.5.19
samba samba 4.1.11
samba samba 3.5.8
samba samba 3.6.1
samba samba 3.6.2
samba samba 3.5.17
samba samba 3.5.2
samba samba 4.0.10
samba samba 3.6.12
samba samba 4.1.4
samba samba 4.0.7
samba samba 4.1.0
samba samba 4.0.1
samba samba 3.5.14
samba samba 4.0.8
samba samba 3.5.21
samba samba 3.6.13
samba samba 3.5.10
samba samba 4.1.10
samba samba 3.6.22
samba samba 3.5.5
samba samba 4.1.15
samba samba 3.5.0
samba samba 3.5.12
samba samba 4.0.0
samba samba 3.5.22
samba samba 3.6.15
samba samba 4.0.5
samba samba 4.1.2
samba samba 4.1.3
samba samba 4.0.18
samba samba 3.5.4
samba samba 3.5.18
samba samba 3.5.20
samba samba 4.1.1
samba samba 3.6.20
samba samba 4.0.23
samba samba 3.6.18
samba samba 3.6.21
samba samba 3.5.15
samba samba 4.1.13
samba samba 3.5.13
samba samba 4.0.12
samba samba 4.0.4
samba samba 4.0.15
samba samba 4.0.20
samba samba 3.6.14
samba samba 4.0.9
samba samba 3.5.16
samba samba 3.6.0
samba samba 3.5.3
novell suse linux enterprise server 12
novell suse linux enterprise desktop 12
novell suse linux enterprise software development kit 12
canonical ubuntu linux 12.04
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04

Samba could be made to run programs as an administrator if it received specially crafted network traffic ...

Debian Bug report logs - #776993 samba: CVE-2014-8143: Elevation of privilege to Active Directory Domain Controller Package: src:samba; Maintainer for src:samba is Debian Samba Maintainers <pkg-samba-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 3 Feb 2015 21:12:01 U ...

Debian Bug report logs - #779033 samba: CVE-2015-0240: unexpected code execution in smbd Package: src:samba; Maintainer for src:samba is Debian Samba Maintainers <pkg-samba-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 23 Feb 2015 13:42:01 UTC Severity: grave Tags: f ...

Synopsis Critical: samba security update Type/Severity Security Advisory: Critical Topic Updated samba packages that fix one security issue are now available forRed Hat Enterprise Linux 62 Advanced Update Support, and Red HatEnterprise Linux 64 and 65 Extended Update SupportRed Hat Product Security has ...

Synopsis Important: samba security update Type/Severity Security Advisory: Important Topic Updated samba packages that fix one security issue are now available forRed Hat Enterprise Linux 7Red Hat Product Security has rated this update as having Important securityimpact A Common Vulnerability Scoring Syst ...

Synopsis Critical: samba4 security update Type/Severity Security Advisory: Critical Topic Updated samba4 packages that fix one security issue are now available forRed Hat Enterprise Linux 64 and 65 Extended Update SupportRed Hat Product Security has rated this update as having Critical securityimpact A ...

Synopsis Critical: samba4 security update Type/Severity Security Advisory: Critical Topic Updated samba4 packages that fix one security issue are now available forRed Hat Enterprise Linux 6Red Hat Product Security has rated this update as having Critical securityimpact A Common Vulnerability Scoring Syste ...

Synopsis Critical: samba security update Type/Severity Security Advisory: Critical Topic Updated samba packages that fix one security issue are now available forRed Hat Storage 3Red Hat Product Security has rated this update as having Critical securityimpact A Common Vulnerability Scoring System (CVSS) ba ...

Synopsis Critical: samba3x security update Type/Severity Security Advisory: Critical Topic Updated samba3x packages that fix one security issue are now available forRed Hat Enterprise Linux 5Red Hat Product Security has rated this update as having Critical securityimpact A Common Vulnerability Scoring Sys ...

Synopsis Critical: samba3x security update Type/Severity Security Advisory: Critical Topic Updated samba3x packages that fix one security issue are now available forRed Hat Enterprise Linux 56 Long Life and Red Hat Enterprise Linux 59Extended Update SupportRed Hat Product Security has rated this update a ...

Synopsis Critical: samba security update Type/Severity Security Advisory: Critical Topic Updated samba packages that fix one security issue are now available forRed Hat Storage 21Red Hat Product Security has rated this update as having Critical securityimpact A Common Vulnerability Scoring System (CVSS) ...

Synopsis Critical: samba security update Type/Severity Security Advisory: Critical Topic Updated samba packages that fix one security issue are now available forRed Hat Enterprise Linux 6Red Hat Product Security has rated this update as having Critical securityimpact A Common Vulnerability Scoring System ...

#!/usr/bin/python """ Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya The exploit only targets vulnerable x86 smbd <3624 which 'creds' is controlled by ReferentID field of PrimaryName (ServerName) That means '_talloc_zero()' in libtalloc does not write a value on 'creds' address Reference: - securityblogredhatcom/2015/ ...

Samb-AAAHH! Scary remote execution vuln spotted in Windows-Linux interop code

The Register • Neil McAllister in San Francisco • 24 Feb 2015

Microsoft finds critical bug that hurts most recent Linuxes

Linux admins were sent scrambling to patch their boxes on Monday after a critical vulnerability was revealed in Samba, the open source Linux-and-Windows-compatibility software. The bug, which has been designated CVE-2015-0240, lies in the smbd file server daemon. Samba versions 3.5.0 through 4.2.0rc4 are affected, the Samba Project said in a security alert. An attacker who successfully exploits the flaw could potentially execute code remotely with root privileges, the project's developers warned...

Get Started

CVE-2015-0240

Vulnerability Summary

Vendor Advisories

Exploits

Recent Articles

References

Vulmon Search

About

Products

Connect