11542 matches found
SUSE CVE-2004-0882
Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a TRANSACT2QFILEPATHINFO request with a small "maximum data bytes" value...
SUSE CVE-2004-0883
Multiple vulnerabilities in the samba filesystem smbfs in Linux kernel 2.4 and 2.6 allow remote samba servers to cause a denial of service crash or gain sensitive information from kernel memory via a samba server 1 returning more data than requested to the smbprocread function, 2 returning a data...
SUSE CVE-2004-0930
The msfnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service CPU consumption via a SAMBA request that contains multiple wildcard characters...
SUSE CVE-2004-0949
The smbrecvtrans2 function call in the samba filesystem smbfs in Linux kernel 2.4 and 2.6 does not properly handle the re-assembly of fragmented packets correctly, which could allow remote samba servers to 1 read arbitrary kernel information or 2 raise a counter value to an arbitrary number by...
SUSE CVE-2004-1154
Integer overflow in the Samba daemon smbd in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service application crash and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer...
SUSE CVE-2005-0022
Buffer overflow in the spabase64tobits function in Exim before 4.43, as originally obtained from Samba code, and as called by the authspaclient function, may allow attackers to execute arbitrary code during SPA authentication...
SUSE CVE-2005-3807
Memory leak in the VFS file lease handling in locks.c in Linux kernels 2.6.10 to 2.6.15 allows local users to cause a denial of service memory exhaustion via certain Samba activities that cause an fasync entry to be re-allocated by the fcntlsetlease function after the fasync queue has already bee...
SUSE CVE-2006-1059
The winbindd daemon in Samba 3.0.21 to 3.0.21c writes the machine trust account password in cleartext in log files, which allows local users to obtain the password and spoof the server in the domain...
SUSE CVE-2006-3403
The smdb daemon smbd/service.c in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service memory consumption via a large number of share connection requests...
SUSE CVE-2007-0452
smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service memory and CPU exhaustion by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop...
SUSE CVE-2007-0454
Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping...
SUSE CVE-2007-2444
Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors that cause the daemon to transition to the root user...
SUSE CVE-2007-2446
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving 1 DFSEnum netdfsiodfsEnumInfod, 2 RFNPCNEX smbionotifyoptiontypedata, 3 LsarAddPrivilegesToAccount...
SUSE CVE-2007-2447
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute...
SUSE CVE-2007-4044
The MS-RPC functionality in smbd in Samba 3 on SUSE Linux before 20070720 does not include "one character in the shell escape handling." NOTE: this issue was originally characterized as a shell metacharacter issue due to an incomplete fix for CVE-2007-2447, which was interpreted by CVE to be...
SUSE CVE-2007-4138
The Winbind nssinfo extension nsswitch/idmapad.c in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the 1 RFC2307 or 2 Services for UNIX SFU primary group attribute is not defined...
SUSE CVE-2007-4572
Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote attackers to have an unknown impact via crafted GETDC mailslot requests, related to handling of GETDC logon server requests...
SUSE CVE-2007-5398
Stack-based buffer overflow in the replynetbiospacket function in nmbd/nmbdpackets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request...
SUSE CVE-2007-6015
Stack-based buffer overflow in the sendmailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON...