Description
Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:3.6.17-1 | — |
| Debian 13 | samba | 2:3.6.17-1 | — |
| Debian 12 | samba | 2:3.6.17-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | samba +11 | 3.6.9-164.el6 | RHSA-2013:1542 |
| RHEL 6 | samba4 +13 | 4.0.0-58.el6.rc4 | RHSA-2013:1543 |
| RHEL 5 | samba +5 | 3.0.33-3.40.el5_10 | RHSA-2014:0305 |
| RHEL 5 | samba3x +7 | 3.6.6-0.136.el5 | RHSA-2013:1310 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.5.0-1.1 | openSUSE-SU-2024:10069-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Samba read_nttrans_ea_list Integer Overflow
auxiliary/dos/samba/read_nttrans_ea_list
Exploit-DB 1
- Samba 3.5.22/3.6.17/4.0.8 - nttrans Reply Integer Overflow EDB-27778 · dos · Aug 22, 2013
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2013:1542 Red Hat Security Advisory: samba security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1310 Red Hat Security Advisory: samba3x security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0305 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1543 Red Hat Security Advisory: samba4 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10069-1 ctdb-4.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- HPSBUX03087 vendor-advisory
- openSUSE-SU-2013:1339 vendor-advisory
- FEDORA-2014-9132 vendor-advisory
- http://www.samba.org/samba/security/CVE-2013-4124
- FEDORA-2013-14312 vendor-advisory
- openSUSE-SU-2013:1349 vendor-advisory
- 20130806 [slackware-security] samba (SSA:2013-218-03) mailing-list
- http://www.samba.org/samba/history/samba-4.0.8.html
- http://www.samba.org/samba/history/samba-3.6.17.html
- USN-1966-1 vendor-advisory
- GLSA-201502-15 vendor-advisory
- 1028882 vdb-entry
- RHSA-2014:0305 vendor-advisory
- http://www.samba.org/samba/history/samba-3.5.22.html
- samba-cve20134121-dos(86185) vdb-entry
- MDVSA-2013:207 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=984401
- FEDORA-2013-14355 vendor-advisory
- 54519 third-party-advisory
- RHSA-2013:1310 vendor-advisory
- http://ftp.samba.org/pub/samba/patches/security/samba-4.0.7-CVE-2013-4124.patch
- RHSA-2013:1542 vendor-advisory
- 95969 vdb-entry
- RHSA-2013:1543 vendor-advisory