221 matches found
cve-2017-7494
Configuración básica Instalar Samba versión 4.5.9 https://download.samba.org/pub/samba/stable/samba-4.5.9.tar.gz https://wiki.samba.org/index.php/BuildSambafromSource Obtener la versión parcheada de Impacket pip install -r requirements.txt Uso 1. Iniciar el servidor Samba en modo interactivo +...
Samba-Exploit-CVE-2007-2447
🎬 Este vídeo de YouTube 1️⃣ Escaneo del objetivo Nmap root@kitploit: nmap -sS -sV -p 139,445 192.168.56.102 Resultado esperado: 139/tcp open netbios-ssn Samba smbd 3.X 445/tcp open microsoft-ds Samba smbd 3.0.20-Debian 👉 Versión de Samba: 3.0.20 Es vulnerable a CVE-2007-2447. 2️⃣ Detección del...
CVE-2007-2447-Exploit
Exploit CVE-2007-2447 Este repositorio contiene un exploit para Samba smbd 3.0.20 CVE-2007-2447 que permite la ejecución remota de comandos mediante solicitudes SMB manipuladas. Requisitos previos Este exploit requiere Python 3 y algunas dependencias. Se recomienda configurar un entorno virtual...
CVE-2007-2447
CVE-2007-2447 - script de mapa de usuario "La funcionalidad MS-RPC en smbd de Samba 3.0.0 hasta 3.0.25rc3 permite a atacantes remotos ejecutar comandos arbitrarios mediante metacaracteres de shell que involucran la función 1 SamrChangePassword, cuando la opción "username map script" de smb.conf...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fixed the smbdirectrecvio leak in the smbdnegotiate error path. During tests of another unrelated patch, I was able to trigger this error: Objects remaining on kmemcacheshutdown...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba. The Samba smbd file server must map Windows group identities SIDs to Unix group IDs gids. The code responsible for this mapping contained a flaw that could allow it to read data beyond the end of the array, in the event that a negative cache entry was added to the...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: The socket is closed after it has been accepted, even when the per-IP limit is exceeded and a connection attempt fails. When the per-IP connection limit is exceeded in ksmbdkthreadfn, the code sets ret to -EAGAIN and...
SUSE CVE-2026-64391
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...
OESA-2026-3157 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A...
CVE-2026-59260
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process,...
CVE-2026-59260
OpenWrt luci-app-samba4 contains an ACL misconfiguration that grants file.exec permission on /usr/sbin/smbd. This allows authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments, enabling remote code execution via the SMB processing path. The vulnera...
CVE-2026-59260 OpenWrt luci-app-samba4 read ACL remote code execution via smbd
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process,...
PT-2026-57557
Name of the Vulnerable Software and Affected Versions luci-app-samba4 affected versions not specified Description An issue in the read Access Control List ACL grants file.exec permission on /usr/sbin/smbd. This allows authenticated delegated users to execute the Samba daemon with command-line...
CVE-2026-59260: Improper Privilege Management
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process,...
CVE-2026-53198
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL A deferred byte-range lock an SMB2LOCK that blocks registers an async work on conn-asyncrequests via setupasyncwork, with cancelfn = smb2removeblockedlock and...
PT-2026-51940
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ksmbd crypt message function when using asynchronous hardware crypto engines, such as the Qualcomm Crypto Engine QCE. The function sets a NULL...
Missing access checks on reparse point
Description Starting with Samba 4.21, users can create and delete NTFS-style reparse points https://en.wikipedia.org/wiki/NTFSreparsepoint via the SMB protocol. The Reparse Point Metadata is stored in an extended attribute named "user.SmbReparse" together with the FILEATTRIBUTEREPARSEPOINT bit in...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ksmbd: A mechToken leak was fixed when the SPNEGO decoding failed after the token allocation. The kernel’s ASN.1 BER decoder calls action callbacks incrementally as it processes the input. When ksmbddecodenegTokenInit reaches the...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: The function ipcvalidatemsg now validates the response sizes. This function calculates the expected message size for each response type by adding or multiplying attacker-controlled fields from the daemon’s response to a...