Description
Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 1:3.0.30-1 | — |
| Debian 13 | samba | 1:3.0.30-1 | — |
| Debian 12 | samba | 1:3.0.30-1 | — |
| Debian 4.0 | samba | 3.0.24-6etch10 | DSA-1590-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | samba +3 | 3.0.28-1.el5_2.1 | RHSA-2008:0290 |
| RHEL 4 | samba +3 | 3.0.25b-1.el4_6.5 | RHSA-2008:0288 |
| RHEL 3 | samba +3 | 3.0.9-1.3E.15 | RHSA-2008:0288 |
| RHEL 2 | samba +3 | 2.2.12-1.21as.9.3 | RHSA-2008:0288 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4.5 EUS | samba +3 | 3.0.10-2.el4_5.3 | RHSA-2008:0289 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cifs-utils | 6.13-1.3 | openSUSE-SU-2024:10683-1 |
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Samba 3.0.29 (Client) - 'receive_smb_raw()' Buffer Overflow (PoC) EDB-5712 · dos · Jun 1, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2008:0289 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0290 Red Hat Security Advisory: samba security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0288 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1590-1 samba - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10683-1 cifs-utils-6.13-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2008:0288 vendor-advisory
- 30478 third-party-advisory
- FEDORA-2008-4724 vendor-advisory
- 30396 third-party-advisory
- http://support.apple.com/kb/HT2163
- 30489 third-party-advisory
- ADV-2008-2639 vdb-entry
- 1020123 vdb-entry
- 30835 third-party-advisory
- ADV-2008-1981 vdb-entry
- 30736 third-party-advisory
- oval:org.mitre.oval:def:5733 vdb-entry signature
- 30385 third-party-advisory
- SSA:2008-149-01 vendor-advisory
- 31911 third-party-advisory
- ADV-2008-1908 vdb-entry
- RHSA-2008:0290 vendor-advisory
- samba-receivesmbraw-bo(42664) vdb-entry
- HPSBUX02341 vendor-advisory
- 5712 exploit
- APPLE-SA-2008-06-30 vendor-advisory
- ADV-2008-2222 vdb-entry
- FEDORA-2008-4797 vendor-advisory
- FEDORA-2008-4679 vendor-advisory
- 249086 vendor-advisory
- 30449 third-party-advisory
- MDVSA-2008:108 vendor-advisory
- 30802 third-party-advisory
- 33696 third-party-advisory
- 30442 third-party-advisory
- 30543 third-party-advisory
- 20080528 [SAMBA] CVE-2008-1105 - Boundary failure when parsing SMB responses mailing-list
- 30228 third-party-advisory
- USN-617-2 vendor-advisory
- http://www.xerox.com/downloads/usa/en/c/cert_XRX08_009.pdf
- USN-617-1 vendor-advisory
- 31255 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2008-0180
- 20080529 Secunia Research: Samba "receive_smb_raw()" Buffer OverflowVulnerability mailing-list
- GLSA-200805-23 vendor-advisory
- http://secunia.com/secunia_research/2008-20/advisory/
- SUSE-SA:2008:026 vendor-advisory
- [Security-announce] 20080728 VMSA-2008-00011 Updated ESX service console packages for Samba and vmnix mailing-list
- oval:org.mitre.oval:def:10020 vdb-entry signature
- xerox-controller-samba-code-execution(45251) vdb-entry
- ADV-2008-1681 vdb-entry
- RHSA-2008:0289 vendor-advisory
- 31246 third-party-advisory
- http://www.samba.org/samba/security/CVE-2008-1105.html
- 29404 vdb-entry
- DSA-1590 vendor-advisory
- 20080602 rPSA-2008-0180-1 samba samba-client samba-server samba-swat mailing-list