9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.059 Low
EPSS
Percentile
93.4%
Samba developers have discovered what is believed to be
a non-exploitable buffer over in nmbd during the processing
of GETDC logon server requests. This code is only used
when the Samba server is configured as a Primary or Backup
Domain Controller.
A patch addressing this defect has been posted to
http://www.samba.org/samba/security/
Additionally, Samba 3.0.27 has been issued as a security
release to correct the defect.
Samba administrators may avoid this security issue by disabling
both the βdomain logonsβ and the βdomain masterβ options in in
the serverβs smb.conf file. Note that this will disable all
domain controller features as well.
This vulnerability was discovered by Samba developers during
an internal code audit.
The time line is as follows:
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team