PT-2007-1122 · Samba+2 · Samba+2

Published 2007-12-10 · Updated 2024-06-15 · CVE-2007-6015

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Samba versions 3.0.0 through 3.0.27a

Description: The issue is related to a stack-based buffer overflow in the send mailslot function in nmbd when the "domain logons" option is enabled. This can be exploited remotely via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request, potentially leading to the execution of arbitrary code. The exploitation of this issue may result in a violation of confidentiality, integrity, and availability of protected information.

Recommendations: For Samba versions 3.0.0 through 3.0.27a, update to version 3.0.28 or later to resolve the issue. As a temporary workaround, consider disabling the "domain logons" option to minimize the risk of exploitation. Restrict access to the nmbd service to reduce the attack surface until a patch is applied.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2020-2443

ALT-PU-2020-2475

ALT-PU-2021-1547

BDU:2015-09613

CVE-2007-6015

DSA-1427-1

DTSA-100-1

HPSBUX02316

HPSBUX02341

OPENSUSE-SU-2024:10683-1

OPENSUSE-SU-2024:11365-1

RHSA-2007:1114

RHSA-2007:1117

RHSA-2007_1114

Affected Products

Alt Linux

Red Hat

Samba

References · 179

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/samba/trans2open.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/samba/trans2open.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/samba/trans2open.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/trans2open.rb · Exploit
• 🔥 https://exploit-db.com/exploits/4732 · Exploit
• https://osv.dev/vulnerability/CVE-2007-6015 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0086 · Security Note
• https://bdu.fstec.ru/vul/2015-07588 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1154 · Security Note
• http://security.gentoo.org/glsa/glsa-200712-10.xml · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-2475 · Vendor Advisory
• http://secunia.com/advisories/27760 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08221 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-6015 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00304.html · Vendor Advisory