Skip to content
OpenAdvisories
Unscored Public exploit CVE-2015-0240 EUVD-2015-0262GHSA-wjcr-wjqx-g6rq

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x befo…

Published Feb 24, 2015 · Updated May 9, 2025 · Assigned by redhat

Package: samba Package: samba Ecosystem: Debian Ecosystem: Ubuntu

Description

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 samba 2:4.1.17+dfsg-1 —
Debian 13 samba 2:4.1.17+dfsg-1 —
Debian 12 samba 2:4.1.17+dfsg-1 —
Debian 7 samba 2:3.6.6-6+deb7u5 DSA-3171-1
Debian 6.0 samba 2:3.5.6~dfsg-3squeeze12 DLA-156-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS samba 2:4.1.6+dfsg-1ubuntu2.14.04.7 USN-2508-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 samba +19 4.1.1-38.el7_0 RHSA-2015:0252
RHEL 6 samba +12 3.6.23-14.el6_6 RHSA-2015:0251
RHEL 6 samba4 +13 4.0.0-66.el6_6.rc4 RHSA-2015:0250
RHEL 5 samba3x +7 3.6.23-9.el5_11 RHSA-2015:0249
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Mission Critical 6 samba +11 3.5.10-119.el6_2 RHSA-2015:0254
Red Hat Rhel Mission Critical 5 samba3x +7 3.5.4-0.70.el5_6.4 RHSA-2015:0253
RHEL 6.5 EUS samba +11 3.6.9-171.el6_5 RHSA-2015:0254
RHEL 6.5 EUS samba4 +13 4.0.0-65.el6_5.rc4 RHSA-2015:0255
RHEL 6.4 EUS samba +11 3.6.9-151.el6_4.3 RHSA-2015:0254
RHEL 6.4 EUS samba4 +13 4.0.0-57.el6_4.rc4 RHSA-2015:0255
RHEL 5.9 EUS samba3x +7 3.6.6-0.131.el5_9 RHSA-2015:0253
Red Hat Gluster Storage 3 samba +12 3.6.509-169.6.el6rhs RHSA-2015:0256
Red Hat Gluster Storage 2 samba +12 3.6.9-167.10.3.el6rhs RHSA-2015:0257

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 samba 4.1.12-16.1 SUSE-SU-2015:0353-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 samba 4.1.12-16.1 SUSE-SU-2015:0353-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed samba 4.5.0-1.1 openSUSE-SU-2024:10069-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 samba +19 4.1.1-38.el7_0 ELSA-2015-0252

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 15

References