Description
Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.10-1 | — |
| Debian 13 | samba | 3.0.10-1 | — |
| Debian 12 | samba | 3.0.10-1 | — |
| Debian 3.0 | samba | 2.2.3a-15 | DSA-701-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | samba +3 | 3.0.9-1.3E.1 | RHSA-2004:670 |
Advisories 2
- RHSA-2004:670 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-701-1 samba - integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.samba.org/samba/security/CAN-2004-1154.html
- 101643 vendor-advisory
- oval:org.mitre.oval:def:10236 vdb-entry signature
- 11973 vdb-entry
- samba-msrpc-heap-corruption(18519) vdb-entry
- RHSA-2005:020 vendor-advisory
- oval:org.mitre.oval:def:642 vdb-entry signature
- 13453 third-party-advisory
- DSA-701 vendor-advisory
- APPLE-SA-2005-03-21 vendor-advisory
- 57730 vendor-advisory
- 20041216 Samba smbd Security Descriptor Integer Overflow Vulnerability third-party-advisory
- SUSE-SA:2004:045 vendor-advisory
- oval:org.mitre.oval:def:1459 vdb-entry signature
- VU#226184 third-party-advisory