A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote user to send a specially crafted print request to a Samba server that could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.
(CVE-2008-1105)

This update also addresses two issues which prevented Samba from joining certain Windows domains with tightened security policies, and prevented certain signed SMB content from working as expected :

  - when some Windows&reg; 2000-based domain controllers     were set to use mandatory signing, Samba clients would     drop the connection because of an error when generating     signatures. This presented as a 'Server packet had     invalid SMB signature' error to the Samba client. This     update corrects the signature generation error.

  - Samba servers using the 'net ads join' command to     connect to a Windows Server&reg; 2003-based domain would     fail with 'failed to get schannel session key from     server' and 'NT_STATUS_ACCESS_DENIED' errors. This     update correctly binds to the NETLOGON share, allowing     Samba servers to connect to the domain properly.

Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. When samba is configured as a Primary or Backup Domain Controller, a remote attacker could send malicious logon requests and possibly cause a denial of service. (CVE-2007-4572)

Alin Rad Pop of Secunia Research discovered that Samba did not properly perform bounds checking when parsing SMB replies. A remote attacker could send crafted SMB packets and execute arbitrary code.
(CVE-2008-1105).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated samba packages that fix a security issue are now available for Red Hat Enterprise Linux 4.5 Extended Update Support.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote user to send a specially crafted print request to a Samba server that could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.
(CVE-2008-1105)

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.

Users of Samba are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2008-78:02 advisory.

    Samba is the suite of programs by which a lot of PC-related machines     share files, printers, and other information (such as lists of     available files and printers). The Windows NT, OS/2, and Linux     operating systems support this natively, and add-on packages can     enable the same thing for DOS, Windows, VMS, UNIX of all kinds, MVS,     and more. This package provides an SMB server that can be used to     provide network services to SMB (sometimes called Lan Manager)     clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT     need the NetBEUI (Microsoft Raw NetBIOS frame) protocol.
    CVE-2008-1105: Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0     through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix CVE-2008-1105 A heap-based buffer overflow flaw has been found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. The Samba server can also act as a client to perform some operations (print notify, domain member vs domain controler ...). This could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.4. 

Mac OS X 10.5.4 contains security fixes for multiple components.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-004 applied. 

This update contains security fixes for a number of programs.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0027 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 8.6. It addresses 74 CVEs:
    CVE-2008-4314, CVE-2018-1050, CVE-2015-7560, CVE-2013-4475, CVE-2019-14907, and 69 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2008:0288 advisory.

    Samba is a suite of programs used by machines to share files, printers, and     other information.

    A heap-based buffer overflow flaw was found in the way Samba clients handle     over-sized packets. If a client connected to a malicious Samba server, it     was possible to execute arbitrary code as the Samba client user. It was     also possible for a remote user to send a specially crafted print request     to a Samba server that could result in the server executing the vulnerable     client code, resulting in arbitrary code execution with the permissions of     the Samba server. (CVE-2008-1105)

    Red Hat would like to thank Alin Rad Pop of Secunia Research for     responsibly disclosing this issue.

    Users of Samba are advised to upgrade to these updated packages, which     contain a backported patch to resolve this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated samba packages that fix a security issue and two bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote user to send a specially crafted print request to a Samba server that could result in the server executing the vulnerable client code, resulting in arbitrary code execution with the permissions of the Samba server.
(CVE-2008-1105)

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.

This update also addresses two issues which prevented Samba from joining certain Windows domains with tightened security policies, and prevented certain signed SMB content from working as expected :

* when some Windows(r) 2000-based domain controllers were set to use mandatory signing, Samba clients would drop the connection because of an error when generating signatures. This presented as a 'Server packet had invalid SMB signature' error to the Samba client. This update corrects the signature generation error.

* Samba servers using the 'net ads join' command to connect to a Windows Server(r) 2003-based domain would fail with 'failed to get schannel session key from server' and 'NT_STATUS_ACCESS_DENIED' errors. This update correctly binds to the NETLOGON share, allowing Samba servers to connect to the domain properly.

Users of Samba are advised to upgrade to these updated packages, which contain a backported patch to resolve these issues.

According to its banner, the version of the Samba server on the remote host is reportedly affected by a boundary error in 'nmbd' within the 'receive_smb_raw' function in 'lib/util_sock.c' when parsing SMB packets received in a client context. By sending specially crafted packets to an 'nmbd' server configured as a local or domain master browser, an attacker can leverage this issue to produce a heap-based buffer overflow and execute arbitrary code with system privileges.

Note that Nessus has not actually tried to exploit this issue, verify the remote 'nmbd' server's configuration, or determine if the fix has been applied.

Alin Rad Pop discovered that Samba contained a buffer overflow condition when processing certain responses received while acting as a client, leading to arbitrary code execution (CVE-2008-1105 ).

USN-617-1 fixed vulnerabilities in Samba. The upstream patch introduced a regression where under certain circumstances accessing large files might cause the client to report an invalid packet length error. This update fixes the problem.

We apologize for the inconvenience.

Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. When samba is configured as a Primary or Backup Domain Controller, a remote attacker could send malicious logon requests and possibly cause a denial of service. (CVE-2007-4572)

Alin Rad Pop of Secunia Research discovered that Samba did not properly perform bounds checking when parsing SMB replies. A remote attacker could send crafted SMB packets and execute arbitrary code. (CVE-2008-1105).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its model number and software version, the remote host is a Xerox WorkCentre device that reportedly allows a remote attacker to execute arbitrary code via specially crafted Service Message Block (SMB) responses due to vulnerabilities in the third-party code it uses to handle file and printer sharing services for SMB clients.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
60413	Scientific Linux Security Update : samba on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
33217	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : samba vulnerabilities (USN-617-1)	Nessus	Ubuntu Local Security Checks	2008/6/18	2021/1/19	high
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
63855	RHEL 4 : samba (RHSA-2008:0289)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
284492	MiracleLinux 3 : samba-3.0.24-10AX (AXSA:2008-78:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
32486	Fedora 7 : samba-3.0.28a-1.fc7 (2008-4797)	Nessus	Fedora Local Security Checks	2008/6/2	2021/1/11	high
33281	Mac OS X 10.5.x < 10.5.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2008/7/1	2024/5/28	critical
33282	Mac OS X Multiple Vulnerabilities (Security Update 2008-004)	Nessus	MacOS X Local Security Checks	2008/7/1	2024/5/28	critical
358859	Rocky Linux 8.6 [CIQ] Security Update: ctdb / libsmbclient / libsmbclient-devel / libwbclient / etc Multiple Vulnerabilities (ciqsa-2026_0027)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
32471	RHEL 4 : samba (RHSA-2008:0288)	Nessus	Red Hat Local Security Checks	2008/5/29	2024/11/4	critical
32472	RHEL 5 : samba (RHSA-2008:0290)	Nessus	Red Hat Local Security Checks	2008/5/29	2021/1/14	high
32476	Samba < 3.0.30 receive_smb_raw Function Remote Buffer Overflow	Nessus	Misc.	2008/5/29	2018/11/15	high
32482	Debian DSA-1590-1 : samba - buffer overflow	Nessus	Debian Local Security Checks	2008/6/2	2021/1/4	high
32483	Fedora 8 : samba-3.0.30-0.fc8 (2008-4679)	Nessus	Fedora Local Security Checks	2008/6/2	2021/1/11	high
33388	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : samba regression (USN-617-2)	Nessus	Ubuntu Local Security Checks	2008/7/2	2021/1/19	high
43686	CentOS 5 : samba (CESA-2008:0290)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high
34244	Xerox WorkCentre Samba Overflow (XRX08-009)	Nessus	Misc.	2008/9/19	2018/11/15	high

检测

插件搜索

high

high

critical

high

critical

high

critical

critical

critical

critical

high

high

high

high

high

high

high