Cloudanix VulnDB

CVE-2015-5370

Medium · 5.9

CVSS

5.9

EPSS

19.1%

Published

Apr 25, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in widely used file-sharing software can let remote attackers knock services offline or potentially run their own programs on connected computers.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Remote Code Execution
Component
Network Service
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper DCE-RPC layer implementation permits protocol downgrade, denial of service via application crash or CPU exhaustion, and potential remote arbitrary code execution on client systems.

Why it matters to the business

Disruption of file and print sharing services, authentication failures, and risk of unauthorized code execution that can lead to data compromise or extended outages in environments relying on Samba for cross-platform interoperability.

How an attack unfolds

An attacker crafts and sends malformed DCE-RPC packets over the network to a vulnerable Samba instance, forcing a protocol downgrade that bypasses security checks and either crashes the service, consumes excessive resources, or executes arbitrary code on connected clients.

How to fix it

Upgrade Samba to version 4.2.11 or later, 4.3.8 or later, or 4.4.2 or later. Apply vendor patches for affected distributions such as Ubuntu and verify no older 3.x branches remain in use.

How to confirm the fix worked

Confirm installed Samba version meets or exceeds the fixed releases, review release notes for DCE-RPC handling changes, and perform functional testing of RPC services under load to ensure stability.

Typical attack path

  1. Scan for exposed Samba services listening on DCE-RPC ports
  2. Send crafted DCE-RPC downgrade or malformed packets
  3. Trigger service crash, resource exhaustion, or code execution path
  4. Establish persistence or exfiltrate data if code execution succeeds

How to detect it

Review Samba logs for unexpected crashes, high CPU events tied to RPC processing, and unusual protocol negotiation failures; inspect network captures for malformed DCE-RPC traffic originating from untrusted sources.

What your security team should do

  • Prioritize patching Samba across all servers and clients within the next maintenance window
  • Restrict DCE-RPC exposure to trusted networks only
  • Enable enhanced logging for RPC traffic and monitor for anomalous packet patterns
  • Test upgrades in a staging environment before broad deployment

The record

Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 samba 0 2:4.3.7+dfsg-1
Debian:12 samba 0 2:4.3.7+dfsg-1
Debian:13 samba 0 2:4.3.7+dfsg-1
Debian:7 samba 0 2:3.6.6-6+deb7u9
Debian:8 samba 0 2:4.2.10+dfsg-0+deb8u1
Mageia:5 samba 0 3.6.25-2.3.mga5
Red Hat:enterprise_linux:5::client samba3x 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-client 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-common 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-debuginfo 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-doc 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-domainjoin-gui 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-swat 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-winbind 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client samba3x-winbind-devel 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-client 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-common 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-debuginfo 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-doc 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-domainjoin-gui 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-swat 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-winbind 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::client_workstation samba3x-winbind-devel 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-client 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-common 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-debuginfo 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-doc 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-domainjoin-gui 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-swat 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-winbind 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:5::server samba3x-winbind-devel 0 0:3.6.23-12.el5_11
Red Hat:enterprise_linux:6::client ipa 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ipa-admintools 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ipa-client 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ipa-debuginfo 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ipa-python 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ipa-server 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ipa-server-selinux 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ipa-server-trust-ad 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::client ldb-tools 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::client libldb 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::client libldb-debuginfo 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::client libldb-devel 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::client libsmbclient 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client libsmbclient-devel 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client libtalloc 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::client libtalloc-debuginfo 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::client libtalloc-devel 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::client libtdb 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::client libtdb-debuginfo 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::client libtdb-devel 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::client libtevent 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::client libtevent-debuginfo 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::client libtevent-devel 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::client openchange 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::client openchange-client 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::client openchange-debuginfo 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::client openchange-devel 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::client openchange-devel-docs 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::client pyldb 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::client pyldb-devel 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::client pytalloc 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::client pytalloc-devel 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::client python-tdb 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::client python-tevent 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::client samba 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-client 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-common 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-debuginfo 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-doc 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-domainjoin-gui 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-glusterfs 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-swat 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-winbind 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-winbind-clients 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-winbind-devel 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba-winbind-krb5-locator 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::client samba4 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-client 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-common 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-dc 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-dc-libs 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-debuginfo 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-devel 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-libs 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-pidl 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-python 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-test 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-winbind 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-winbind-clients 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client samba4-winbind-krb5-locator 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::client tdb-tools 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::computenode ipa 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ipa-admintools 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ipa-client 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ipa-debuginfo 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ipa-python 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ipa-server 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ipa-server-selinux 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ipa-server-trust-ad 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::computenode ldb-tools 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::computenode libldb 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::computenode libldb-debuginfo 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::computenode libldb-devel 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::computenode libsmbclient 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode libsmbclient-devel 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode libtalloc 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::computenode libtalloc-debuginfo 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::computenode libtalloc-devel 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::computenode libtdb 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::computenode libtdb-debuginfo 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::computenode libtdb-devel 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::computenode libtevent 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::computenode libtevent-debuginfo 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::computenode libtevent-devel 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::computenode pyldb 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::computenode pyldb-devel 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::computenode pytalloc 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::computenode pytalloc-devel 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::computenode python-tdb 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::computenode python-tevent 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::computenode samba 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-client 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-common 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-debuginfo 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-doc 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-domainjoin-gui 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-glusterfs 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-swat 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-winbind 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-winbind-clients 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-winbind-devel 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba-winbind-krb5-locator 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::computenode samba4 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-client 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-common 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-dc 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-dc-libs 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-debuginfo 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-devel 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-libs 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-pidl 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-python 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-test 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-winbind 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-winbind-clients 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode samba4-winbind-krb5-locator 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::computenode tdb-tools 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::server ipa 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ipa-admintools 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ipa-client 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ipa-debuginfo 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ipa-python 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ipa-server 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ipa-server-selinux 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ipa-server-trust-ad 0 0:3.0.0-47.el6_7.2
Red Hat:enterprise_linux:6::server ldb-tools 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::server libldb 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::server libldb-debuginfo 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::server libldb-devel 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::server libsmbclient 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server libsmbclient-devel 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server libtalloc 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::server libtalloc-debuginfo 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::server libtalloc-devel 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::server libtdb 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::server libtdb-debuginfo 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::server libtdb-devel 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::server libtevent 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::server libtevent-debuginfo 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::server libtevent-devel 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::server openchange 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::server openchange-client 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::server openchange-debuginfo 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::server openchange-devel 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::server openchange-devel-docs 0 0:1.0-7.el6_7
Red Hat:enterprise_linux:6::server pyldb 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::server pyldb-devel 0 0:1.1.25-2.el6_7
Red Hat:enterprise_linux:6::server pytalloc 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::server pytalloc-devel 0 0:2.1.5-1.el6_7
Red Hat:enterprise_linux:6::server python-tdb 0 0:1.3.8-1.el6_7
Red Hat:enterprise_linux:6::server python-tevent 0 0:0.9.26-2.el6_7
Red Hat:enterprise_linux:6::server samba 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-client 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-common 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-debuginfo 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-doc 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-domainjoin-gui 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-glusterfs 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-swat 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-winbind 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-winbind-clients 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-winbind-devel 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba-winbind-krb5-locator 0 0:3.6.23-30.el6_7
Red Hat:enterprise_linux:6::server samba4 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::server samba4-client 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::server samba4-common 0 0:4.2.10-6.el6_7
Red Hat:enterprise_linux:6::server samba4-dc 0 0:4.2.10-6.el6_7

Related vulnerabilities