CVE-2007-6015
NoneCVSS
—
EPSS
27.5%
Published
Dec 13, 2007
CISA due date
—
The record
Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | samba | 0 | 3.0.28-1 |
| Debian:11 | samba | 0 | 3.0.28-1 |
| Debian:12 | samba | 0 | 3.0.28-1 |
| Debian:13 | samba | 0 | 3.0.28-1 |
| Debian:3.1 | samba | 0 | 3.0.14a-3sarge11 |
| Debian:4.0 | samba | 0 | 3.0.24-6etch9 |
| Debian:5.0 | samba | 0 | 3.0.28-1~lenny1 |
| Red Hat:enterprise_linux:2.1::as | samba | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::as | samba-client | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::as | samba-common | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::as | samba-swat | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::aw | samba | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::aw | samba-client | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::aw | samba-common | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::aw | samba-swat | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::es | samba | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::es | samba-client | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::es | samba-common | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::es | samba-swat | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::ws | samba | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::ws | samba-client | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::ws | samba-common | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:2.1::ws | samba-swat | 0 | 0:2.2.12-1.21as.8.2 |
| Red Hat:enterprise_linux:3::as | samba | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::as | samba-client | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::as | samba-common | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::as | samba-debuginfo | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::as | samba-swat | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::desktop | samba | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::desktop | samba-client | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::desktop | samba-common | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::desktop | samba-debuginfo | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::desktop | samba-swat | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::es | samba | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::es | samba-client | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::es | samba-common | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::es | samba-debuginfo | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::es | samba-swat | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::ws | samba | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::ws | samba-client | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::ws | samba-common | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::ws | samba-debuginfo | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:3::ws | samba-swat | 0 | 0:3.0.9-1.3E.14.3 |
| Red Hat:enterprise_linux:4::as | samba | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::as | samba-client | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::as | samba-common | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::as | samba-debuginfo | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::as | samba-swat | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::desktop | samba | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::desktop | samba-client | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::desktop | samba-common | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::desktop | samba-debuginfo | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::desktop | samba-swat | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::es | samba | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::es | samba-client | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::es | samba-common | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::es | samba-debuginfo | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::es | samba-swat | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::ws | samba | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::ws | samba-client | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::ws | samba-common | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::ws | samba-debuginfo | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:4::ws | samba-swat | 0 | 0:3.0.25b-1.el4_6.4 |
| Red Hat:enterprise_linux:5::client | samba | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::client | samba-client | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::client | samba-common | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::client | samba-debuginfo | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::client | samba-swat | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::server | samba | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::server | samba-client | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::server | samba-common | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::server | samba-debuginfo | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:enterprise_linux:5::server | samba-swat | 0 | 0:3.0.25b-1.el5_1.4 |
| Red Hat:rhel_eus:4.5::as | samba | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::as | samba-client | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::as | samba-common | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::as | samba-debuginfo | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::as | samba-swat | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::es | samba | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::es | samba-client | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::es | samba-common | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::es | samba-debuginfo | 0 | 0:3.0.10-2.el4_5.2 |
| Red Hat:rhel_eus:4.5::es | samba-swat | 0 | 0:3.0.10-2.el4_5.2 |
| openSUSE:Tumbleweed | cifs-utils | 0 | 6.13-1.3 |
| openSUSE:Tumbleweed | samba | 0 | 4.14.6+git.182.2205d5224e3-1.1 |
Related vulnerabilities
- CVE-2014-0178 Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain… Also affects samba
- CVE-2013-4124 Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x… Also affects samba
- CVE-2011-2522 Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web… Also affects samba
- CVE-2010-2063 Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in… Also affects samba
- CVE-2010-0926 The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x… Also affects samba
- CVE-2008-1105 Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0… Also affects samba
- CVE-2007-5398 Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c… Also affects samba
- CVE-2007-2446 Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through… Also affects samba