Description
Samba 3.0.6 and earlier allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via certain malformed requests that cause new processes to be spawned and enter an infinite loop.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.7 | — |
| Debian 13 | samba | 3.0.7 | — |
| Debian 12 | samba | 3.0.7 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | samba +3 | 3.0.7-1.3E | RHSA-2004:467 |
Advisories 1
- RHSA-2004:467 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- oval:org.mitre.oval:def:11141 vdb-entry signature
- 2004-0046 vendor-advisory
- RHSA-2004:467 vendor-advisory
- 20040913 Samba 3.x SMBD Remote Denial of Service Vulnerability third-party-advisory
- 20040913 Samba 3.0 DoS Vulberabilities (CAN-2004-0807 & CAN-2004-0808) mailing-list
- 20040915 [OpenPKG-SA-2004.040] OpenPKG Security Advisory (samba) mailing-list
- CLA-2004:873 vendor-advisory
- MDKSA-2004:092 vendor-advisory
- GLSA-200409-16 vendor-advisory