CVE-2015-0240

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://advisories.mageia.org/MGASA-2015-0084.html
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00028.html
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00030.html
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00031.html
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00035.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html
http://marc.info/?l=bugtraq&m=142722696102151&w=2
http://marc.info/?l=bugtraq&m=143039217203031&w=2
http://rhn.redhat.com/errata/RHSA-2015-0249.html
http://rhn.redhat.com/errata/RHSA-2015-0250.html
http://rhn.redhat.com/errata/RHSA-2015-0251.html
http://rhn.redhat.com/errata/RHSA-2015-0252.html
http://rhn.redhat.com/errata/RHSA-2015-0253.html
http://rhn.redhat.com/errata/RHSA-2015-0254.html
http://rhn.redhat.com/errata/RHSA-2015-0255.html
http://rhn.redhat.com/errata/RHSA-2015-0256.html
http://rhn.redhat.com/errata/RHSA-2015-0257.html
http://security.gentoo.org/glsa/glsa-201502-15.xml
http://www.debian.org/security/2015/dsa-3171
http://www.mandriva.com/security/advisories?name=MDVSA-2015:081
http://www.mandriva.com/security/advisories?name=MDVSA-2015:082
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.securityfocus.com/bid/72711
http://www.securitytracker.com/id/1031783
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.360345
http://www.ubuntu.com/usn/USN-2508-1
https://access.redhat.com/articles/1346913
https://bugzilla.redhat.com/show_bug.cgi?id=1191325
https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/	Exploit
https://support.lenovo.com/product_security/samba_remote_vuln
https://support.lenovo.com/us/en/product_security/samba_remote_vuln
https://www.exploit-db.com/exploits/36741/
https://www.samba.org/samba/security/CVE-2015-0240	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux:5:::::::*
	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:samba:samba:3.5.0:::::::*
	cpe:2.3:a:samba:samba:3.5.1:::::::*
	cpe:2.3:a:samba:samba:3.5.2:::::::*
	cpe:2.3:a:samba:samba:3.5.3:::::::*
	cpe:2.3:a:samba:samba:3.5.4:::::::*
	cpe:2.3:a:samba:samba:3.5.5:::::::*
	cpe:2.3:a:samba:samba:3.5.6:::::::*
	cpe:2.3:a:samba:samba:3.5.7:::::::*
	cpe:2.3:a:samba:samba:3.5.8:::::::*
	cpe:2.3:a:samba:samba:3.5.9:::::::*
	cpe:2.3:a:samba:samba:3.5.10:::::::*
	cpe:2.3:a:samba:samba:3.5.11:::::::*
	cpe:2.3:a:samba:samba:3.5.12:::::::*
	cpe:2.3:a:samba:samba:3.5.13:::::::*
	cpe:2.3:a:samba:samba:3.5.14:::::::*
	cpe:2.3:a:samba:samba:3.5.15:::::::*
	cpe:2.3:a:samba:samba:3.5.16:::::::*
	cpe:2.3:a:samba:samba:3.5.17:::::::*
	cpe:2.3:a:samba:samba:3.5.18:::::::*
	cpe:2.3:a:samba:samba:3.5.19:::::::*
	cpe:2.3:a:samba:samba:3.5.20:::::::*
	cpe:2.3:a:samba:samba:3.5.21:::::::*
	cpe:2.3:a:samba:samba:3.5.22:::::::*
	cpe:2.3:a:samba:samba:3.6.0:::::::*
	cpe:2.3:a:samba:samba:3.6.1:::::::*
	cpe:2.3:a:samba:samba:3.6.2:::::::*
	cpe:2.3:a:samba:samba:3.6.10:::::::*
	cpe:2.3:a:samba:samba:3.6.11:::::::*
	cpe:2.3:a:samba:samba:3.6.12:::::::*
	cpe:2.3:a:samba:samba:3.6.13:::::::*
	cpe:2.3:a:samba:samba:3.6.14:::::::*
	cpe:2.3:a:samba:samba:3.6.15:::::::*
	cpe:2.3:a:samba:samba:3.6.16:::::::*
	cpe:2.3:a:samba:samba:3.6.17:::::::*
	cpe:2.3:a:samba:samba:3.6.18:::::::*
	cpe:2.3:a:samba:samba:3.6.19:::::::*
	cpe:2.3:a:samba:samba:3.6.20:::::::*
	cpe:2.3:a:samba:samba:3.6.21:::::::*
	cpe:2.3:a:samba:samba:3.6.22:::::::*
	cpe:2.3:a:samba:samba:3.6.23:::::::*
	cpe:2.3:a:samba:samba:3.6.24:::::::*
	cpe:2.3:a:samba:samba:4.0.0:::::::*
	cpe:2.3:a:samba:samba:4.0.1:::::::*
	cpe:2.3:a:samba:samba:4.0.2:::::::*
	cpe:2.3:a:samba:samba:4.0.3:::::::*
	cpe:2.3:a:samba:samba:4.0.4:::::::*
	cpe:2.3:a:samba:samba:4.0.5:::::::*
	cpe:2.3:a:samba:samba:4.0.6:::::::*
	cpe:2.3:a:samba:samba:4.0.7:::::::*
	cpe:2.3:a:samba:samba:4.0.8:::::::*
	cpe:2.3:a:samba:samba:4.0.9:::::::*
	cpe:2.3:a:samba:samba:4.0.10:::::::*
	cpe:2.3:a:samba:samba:4.0.11:::::::*
	cpe:2.3:a:samba:samba:4.0.12:::::::*
	cpe:2.3:a:samba:samba:4.0.13:::::::*
	cpe:2.3:a:samba:samba:4.0.14:::::::*
	cpe:2.3:a:samba:samba:4.0.15:::::::*
	cpe:2.3:a:samba:samba:4.0.16:::::::*
	cpe:2.3:a:samba:samba:4.0.17:::::::*
	cpe:2.3:a:samba:samba:4.0.18:::::::*
	cpe:2.3:a:samba:samba:4.0.19:::::::*
	cpe:2.3:a:samba:samba:4.0.20:::::::*
	cpe:2.3:a:samba:samba:4.0.21:::::::*
	cpe:2.3:a:samba:samba:4.0.22:::::::*
cpe:2.3:a:samba:samba:4.0.23:::::::*
cpe:2.3:a:samba:samba:4.0.24:::::::*
cpe:2.3:a:samba:samba:4.1.0:::::::*
cpe:2.3:a:samba:samba:4.1.1:::::::*
cpe:2.3:a:samba:samba:4.1.2:::::::*
cpe:2.3:a:samba:samba:4.1.3:::::::*
cpe:2.3:a:samba:samba:4.1.4:::::::*
cpe:2.3:a:samba:samba:4.1.5:::::::*
cpe:2.3:a:samba:samba:4.1.6:::::::*
cpe:2.3:a:samba:samba:4.1.7:::::::*
cpe:2.3:a:samba:samba:4.1.8:::::::*
cpe:2.3:a:samba:samba:4.1.9:::::::*
cpe:2.3:a:samba:samba:4.1.10:::::::*
cpe:2.3:a:samba:samba:4.1.11:::::::*
cpe:2.3:a:samba:samba:4.1.12:::::::*
cpe:2.3:a:samba:samba:4.1.13:::::::*
cpe:2.3:a:samba:samba:4.1.14:::::::*
cpe:2.3:a:samba:samba:4.1.15:::::::*
cpe:2.3:a:samba:samba:4.1.16:::::::*
cpe:2.3:a:samba:samba:4.2.0:rc1::::::
cpe:2.3:a:samba:samba:4.2.0:rc2::::::
cpe:2.3:a:samba:samba:4.2.0:rc3::::::
cpe:2.3:a:samba:samba:4.2.0:rc4::::::

Configuration 3 (hide)

OR	cpe:2.3:o:novell:suse_linux_enterprise_desktop:12:::::::*
	cpe:2.3:o:novell:suse_linux_enterprise_server:12:::::::*
	cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12:::::::*

Configuration 4 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*

History

13 Feb 2023, 00:45

Type	Values Removed	Values Added
References	~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0251', 'name': 'https://access.redhat.com/errata/RHSA-2015:0251', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0253', 'name': 'https://access.redhat.com/errata/RHSA-2015:0253', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/security/cve/CVE-2015-0240', 'name': 'https://access.redhat.com/security/cve/CVE-2015-0240', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0257', 'name': 'https://access.redhat.com/errata/RHSA-2015:0257', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0250', 'name': 'https://access.redhat.com/errata/RHSA-2015:0250', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0256', 'name': 'https://access.redhat.com/errata/RHSA-2015:0256', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0255', 'name': 'https://access.redhat.com/errata/RHSA-2015:0255', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0249', 'name': 'https://access.redhat.com/errata/RHSA-2015:0249', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0252', 'name': 'https://access.redhat.com/errata/RHSA-2015:0252', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2015:0254', 'name': 'https://access.redhat.com/errata/RHSA-2015:0254', 'tags': [], 'refsource': 'MISC'}~~
Summary	An uninitialized pointer use flaw was found in the Samba daemon (smbd). A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges of the user running smbd (by default, the root user).	The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

02 Feb 2023, 20:20

Type	Values Removed	Values Added
References		(MISC) https://access.redhat.com/errata/RHSA-2015:0251 - (MISC) https://access.redhat.com/errata/RHSA-2015:0253 - (MISC) https://access.redhat.com/security/cve/CVE-2015-0240 - (MISC) https://access.redhat.com/errata/RHSA-2015:0257 - (MISC) https://access.redhat.com/errata/RHSA-2015:0250 - (MISC) https://access.redhat.com/errata/RHSA-2015:0256 - (MISC) https://access.redhat.com/errata/RHSA-2015:0255 - (MISC) https://access.redhat.com/errata/RHSA-2015:0249 - (MISC) https://access.redhat.com/errata/RHSA-2015:0252 - (MISC) https://access.redhat.com/errata/RHSA-2015:0254 -
Summary	The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.	An uninitialized pointer use flaw was found in the Samba daemon (smbd). A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges of the user running smbd (by default, the root user).

Information

Published : 2015-02-24 01:59

Updated : 2023-12-10 11:31

NVD link : CVE-2015-0240

Mitre link : CVE-2015-0240

CVE.ORG link : CVE-2015-0240

JSON object : View

Products Affected

novell

suse_linux_enterprise_software_development_kit
suse_linux_enterprise_server
suse_linux_enterprise_desktop

redhat

enterprise_linux

canonical

ubuntu_linux

samba

samba

CWE

CWE-17

DEPRECATED: Code

10.0 /10