Description
Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.27-1 | — |
| Debian 13 | samba | 3.0.27-1 | — |
| Debian 12 | samba | 3.0.27-1 | — |
| Debian 4.0 | samba | 3.0.24-6etch5 | DSA-1409-3, DSA-1409-2, DSA-1409-1 |
| Debian 3.1 | samba | 3.0.14a-3sarge7 | DSA-1409-3, DSA-1409-2, DSA-1409-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | samba +3 | 3.0.25b-1.el5_1.2 | RHSA-2007:1017 |
| RHEL 4 | samba +3 | 3.0.25b-1.el4_6.2 | RHSA-2007:1016 |
| RHEL 3 | samba +3 | 3.0.9-1.3E.14.1 | RHSA-2007:1013 |
| RHEL 2 | samba +3 | 2.2.12-1.21as.8.1 | RHSA-2007:1013 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4.5 EUS | samba +3 | 3.0.10-2.el4_5.1 | RHSA-2007:1034 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cifs-utils | 6.13-1.3 | openSUSE-SU-2024:10683-1 |
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Advisories 9
- RHSA-2007:1034 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1017 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1016 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1013 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1409-1 samba - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1409-3 samba - several vulnerabilities (update) Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1409-2 samba - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10683-1 cifs-utils-6.13-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 27691 third-party-advisory
- http://secunia.com/secunia_research/2007-90/advisory/
- oval:org.mitre.oval:def:10230 vdb-entry signature
- RHSA-2007:1016 vendor-advisory
- USN-544-1 vendor-advisory
- ADV-2007-4238 vdb-entry
- TA07-352A third-party-advisory
- 30835 third-party-advisory
- 29341 third-party-advisory
- SSA:2007-320-01 vendor-advisory
- HPSBUX02316 vendor-advisory
- oval:org.mitre.oval:def:5811 vdb-entry signature
- 28136 third-party-advisory
- ADV-2007-3869 vdb-entry
- 27679 third-party-advisory
- 27682 third-party-advisory
- 27701 third-party-advisory
- 1018953 vdb-entry
- RHSA-2007:1013 vendor-advisory
- ADV-2008-1908 vdb-entry
- 27720 third-party-advisory
- 27742 third-party-advisory
- HPSBUX02341 vendor-advisory
- 30484 third-party-advisory
- 20080108 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- DSA-1409 vendor-advisory
- 27450 third-party-advisory
- 27731 third-party-advisory
- [Security-announce] 20080107 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- APPLE-SA-2007-12-17 vendor-advisory
- MDKSA-2007:224 vendor-advisory
- 27787 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307179
- 28368 third-party-advisory
- 26455 vdb-entry
- https://issues.rpath.com/browse/RPL-1894
- GLSA-200711-29 vendor-advisory
- 20071115 Secunia Research: Samba "reply_netbios_packet()" Buffer OverflowVulnerability mailing-list
- FEDORA-2007-3402 vendor-advisory
- 27927 third-party-advisory
- ADV-2008-1712 vdb-entry
- ADV-2008-0859 vdb-entry
- 3372 third-party-advisory
- 237764 vendor-advisory
- http://us1.samba.org/samba/security/CVE-2007-5398.html
- http://www.vmware.com/security/advisories/VMSA-2008-0001.html
- RHSA-2007:1017 vendor-advisory
- ADV-2008-0064 vdb-entry
- samba-replynetbiospacket-bo(38502) vdb-entry
- SUSE-SA:2007:065 vendor-advisory
- 20080123 UPDATED VMSA-2008-0001.1 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list