Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Samba 3.0.0 <= 3.6.3 Remote Code Execution Vulnerability (CVE-2012-1182)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
Samba 3.0.x to 3.6.3 are affected by a vulnerability that allows remote code execution as the 'root' user.
Insight
Insight
Samba versions 3.6.3 and all versions previous to this are affected by a vulnerability that allows remote code execution as the 'root' user from an anonymous connection. The code generator for Samba's remote procedure call (RPC) code contained an error which caused it to generate code containing a security flaw. This generated code is used in the parts of Samba that control marshalling and unmarshalling of RPC calls over the network. The flaw caused checks on the variable containing the length of an allocated array to be done independently from the checks on the variable used to allocate the memory for that array. As both these variables are controlled by the connecting client it makes it possible for a specially crafted RPC call to cause the server to execute arbitrary code. As this does not require an authenticated connection it is the most serious vulnerability possible in a program, and users and vendors are encouraged to patch their Samba installations immediately.
Affected Software
Affected Software
Samba versions 3.0.0 through 3.6.3.
Detection Method
Detection Method
Checks if a vulnerable version is present on the target host.
Solution
Solution
Update to version 3.4.16, 3.5.14, 3.6.4 or later.