Description
Buffer overflow in Samba 2.2.x to 2.2.9, and 3.0.0 to 3.0.4, when the "mangling method = hash" option is enabled in smb.conf, has unknown impact and attack vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.5 | — |
| Debian 13 | samba | 3.0.5 | — |
| Debian 12 | samba | 3.0.5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | samba +3 | 3.0.4-6.3E | RHSA-2004:259 |
Advisories 1
- RHSA-2004:259 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 2004-0039 vendor-advisory
- CLA-2004:851 vendor-advisory
- RHSA-2004:259 vendor-advisory
- 20040722 TSSA-2004-014 - samba mailing-list
- CLA-2004:854 vendor-advisory
- 20040722 [OpenPKG-SA-2004.033] OpenPKG Security Advisory (samba) mailing-list
- SUSE-SA:2004:022 vendor-advisory
- 20040722 Security Release - Samba 3.0.5 and 2.2.10 mailing-list
- MDKSA-2004:071 vendor-advisory
- FLSA:2102 vendor-advisory
- samba-mangling-method-bo(16786) vdb-entry
- SSRT4782 vendor-advisory
- GLSA-200407-21 vendor-advisory
- 57664 vendor-advisory
- 101584 vendor-advisory
- oval:org.mitre.oval:def:10461 vdb-entry signature