Description
Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2.2.7 | — |
| Debian 13 | samba | 2.2.7 | — |
| Debian 12 | samba | 2.2.7 | — |
| Debian 3.0 | samba | 2.2.3a-12 | DSA-200 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
exploit/multi/samba/nttrans
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-200 samba - remote exploit Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:1467 vdb-entry signature
- VU#958321 third-party-advisory
- CLA-2002:550 vendor-advisory
- samba-password-change-bo(10683) vdb-entry
- SuSE-SA:2002:045 vendor-advisory
- http://us1.samba.org/samba/whatsnew/samba-2.2.7.html
- 20021121 GLSA: samba mailing-list
- DSA-200 vendor-advisory
- HPSBUX0212-230 vendor-advisory
- 20021129 [OpenPKG-SA-2002.012] OpenPKG Security Advisory (samba) mailing-list
- N-019 third-party-advisory government-resource
- 6210 vdb-entry
- RHSA-2002:266 vendor-advisory
- 53580 vendor-advisory
- MDKSA-2002:081 vendor-advisory