The reply_sesssetup_and_X_spnego function in sesssetup.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to trigger an out-of-bounds read, and cause a denial of service (process crash), via a \xff\xff security blob length in a Session Setup AndX request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade samba | Jul 30, 2024 | Jun 17, 2010 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Oct 30, 2017 | Jun 17, 2010 |
| Samba | — | Upgrade to Samba version 3.4.8Upgrade to Samba version 3.5.2 | Apr 30, 2018 | Jun 17, 2010 |
| Suse | — | Upgrade libndr-nbt0Upgrade libsamba-util0-32bitUpgrade libdcerpc0Upgrade libregistry-develUpgrade libwbclient0-x86Upgrade libpdb0Upgrade samba-libsUpgrade libndr-nbt-develUpgrade samba-dsdb-modulesUpgrade libtevent-util0Upgrade libgensec-develUpgrade libsamba-passdb-develUpgrade samba-develUpgrade libtevent-util-develUpgrade samba-client-x86Upgrade samba-kdcUpgrade samba-ad-dc-libsUpgrade libsamba-policy0Upgrade libregistry0Upgrade samba-docUpgrade libsamba-util-develUpgrade libndr-standard0-32bitUpgrade libdcerpc-samr-develUpgrade samba-libs-32bitUpgrade libsmbclient-develUpgrade libtalloc-develUpgrade libnetapi0-32bitUpgrade libtalloc2Upgrade libndr-standard-develUpgrade libdcerpc-binding0Upgrade samba-winbind-libs-langUpgrade libsamba-hostconfig0Upgrade libsamba-credentials0Upgrade libsmbclient-raw-develUpgrade libtevent0-32bitUpgrade samba-winbindUpgrade libdcerpc-develUpgrade ldapsmbUpgrade libtevent0-x86Upgrade libdcerpc0-32bitUpgrade libsmbldap0-32bitUpgrade libpdb-develUpgrade libtevent-develUpgrade libsamba-credentials-develUpgrade libsmbsharemodes0Upgrade sambaUpgrade libsamba-passdb0-32bitUpgrade libsmbclient0-x86Upgrade samba-pythonUpgrade libsmbclient0-32bitUpgrade libtdb1Upgrade samba-libs-python3Upgrade samba-clientUpgrade libsmbldap2-32bitUpgrade samba-client-32bitUpgrade samba-32bitUpgrade libtevent0Upgrade libtevent-util0-32bitUpgrade samba-client-libsUpgrade ldb-toolsUpgrade samba-winbind-x86Upgrade libpdb0-32bitUpgrade libsamba-policy-develUpgrade libldb2Upgrade libtalloc2-32bitUpgrade libwbclient0Upgrade samba-winbind-32bitUpgrade samba-ldb-ldapUpgrade libsamdb0Upgrade samba-client-langUpgrade libsamba-passdb0Upgrade libsamba-errors0Upgrade libsmbldap-develUpgrade libgensec0-32bitUpgrade samba-x86Upgrade samba-ad-dcUpgrade samba-libs-python3-32bitUpgrade libwbclient0-32bitUpgrade libsamba-errors-develUpgrade libsamba-hostconfig-develUpgrade libwbclient-develUpgrade libldb1Upgrade samba-toolUpgrade libsmbclient-raw0-32bitUpgrade samba-dcerpcUpgrade libdcerpc-atsvc0Upgrade libsmbclient0Upgrade samba-test-develUpgrade libtdb1-x86Upgrade libndr-krb5pac-develUpgrade libsamdb-develUpgrade libsmbconf0-32bitUpgrade libsmbsharemodes-develUpgrade libdcerpc-binding0-32bitUpgrade libdcerpc-atsvc-develUpgrade samba-python3Upgrade libdcerpc-samr0Upgrade samba-krb-printingUpgrade libgensec0Upgrade samba-testUpgrade libndr0Upgrade samba-gpupdateUpgrade libsmbldap2Upgrade samba-core-develUpgrade libsmbconf0Upgrade libndr-nbt0-32bitUpgrade libtdb-develUpgrade libsamba-credentials0-32bitUpgrade libsamba-errors0-32bitUpgrade libndr0-32bitUpgrade libsmbldap0Upgrade libnetapi-develUpgrade libndr-krb5pac0Upgrade libndr-standard0Upgrade ctdbUpgrade libsamba-util0Upgrade libndr-krb5pac0-32bitUpgrade samba-winbind-libsUpgrade libtdb1-32bitUpgrade libsamba-hostconfig0-32bitUpgrade libtalloc2-x86Upgrade libndr-develUpgrade python3-ldbUpgrade libldb-develUpgrade ctdb-pcp-pmdaUpgrade libsamdb0-32bitUpgrade libnetapi0Upgrade libsmbclient-raw0Upgrade libsmbconf-devel | Feb 17, 2015 | Jul 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub