Description
smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.23d-5 | — |
| Debian 13 | samba | 3.0.23d-5 | — |
| Debian 12 | samba | 3.0.23d-5 | — |
| Debian 3.1 | samba | 3.0.14a-3sarge4 | DSA-1257-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | samba +3 | 3.0.23c-2.el5.2 | RHSA-2007:0061 |
| RHEL 4 | samba +3 | 3.0.10-1.4E.11 | RHSA-2007:0060 |
| RHEL 3 | samba +3 | 3.0.9-1.3E.12 | RHSA-2007:0060 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cifs-utils | 6.13-1.3 | openSUSE-SU-2024:10683-1 |
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Advisories 5
- RHSA-2007:0061 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0060 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1257-1 samba Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10683-1 cifs-utils-6.13-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 24046 third-party-advisory
- 24101 third-party-advisory
- 24076 third-party-advisory
- 20070207 rPSA-2007-0026-1 samba samba-swat mailing-list
- SSRT071341 vendor-advisory
- GLSA-200702-01 vendor-advisory
- 2219 third-party-advisory
- ADV-2007-1278 vdb-entry
- 24151 third-party-advisory
- ADV-2007-0483 vdb-entry
- 24030 third-party-advisory
- 24140 third-party-advisory
- http://us1.samba.org/samba/security/CVE-2007-0452.html
- 24021 third-party-advisory
- 24284 third-party-advisory
- 20070205 [SAMBA-SECURITY] CVE-2007-0452: Potential DoS against smbd in Samba 3.0.6 - 3.0.23d mailing-list
- 22395 vdb-entry
- https://issues.rpath.com/browse/RPL-1005
- 1017587 vdb-entry
- 24067 third-party-advisory
- 24145 third-party-advisory
- 24060 third-party-advisory
- RHSA-2007:0060 vendor-advisory
- 33100 vdb-entry
- MDKSA-2007:034 vendor-advisory
- 2007-0007 vendor-advisory
- USN-419-1 vendor-advisory
- 200588 vendor-advisory
- FEDORA-2007-219 vendor-advisory
- RHSA-2007:0061 vendor-advisory
- FEDORA-2007-220 vendor-advisory
- SSA:2007-038-01 vendor-advisory
- 24792 third-party-advisory
- samba-smbd-filerename-dos(32301) vdb-entry
- DSA-1257 vendor-advisory
- 24188 third-party-advisory
- oval:org.mitre.oval:def:9758 vdb-entry signature
- SUSE-SA:2007:016 vendor-advisory