VIR Vulnerability Intelligence Relay

CVE-2015-0240

critical
Published 2015-02-24 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
10.0

Description

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

Predictions

Exploit likelihood
55%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-36741 dos linux_x86
sleepya · 2015-04-13

Samba < 3.6.2 (x86) - Denial of Service (PoC)

Source code queued for fetch — refresh in a moment.

Metasploit modules

auxiliary_scanner/smb/smb_uninit_cred rank 300
Samba _netr_ServerPasswordSet Uninitialized Credential State
Source fetch failed: fetch_error — view the original via the link above.

OS impact
redhat Red Hat Affected 3 releases
VersionStatusFixed in
7.0 Affected —
6.0 Affected —
5 Affected —
suse SUSE Affected 1 release
VersionStatusFixed in
12 Affected —
ubuntu Ubuntu Affected 3 releases
VersionStatusFixed in
14.10 Affected —
14.04 Affected —
12.04 Affected —
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 2:4.1.17+dfsg-1
sid Fixed 2:4.1.17+dfsg-1
forky Fixed 2:4.1.17+dfsg-1
bullseye Fixed 2:4.1.17+dfsg-1
bookworm Fixed 2:4.1.17+dfsg-1

Application impact
VendorProductVersionsFixed
sambasamba3.5.0
sambasamba3.5.1
sambasamba3.5.2
sambasamba3.5.3
sambasamba3.5.4
sambasamba3.5.5
sambasamba3.5.6
sambasamba3.5.7
sambasamba3.5.8
sambasamba3.5.9
sambasamba3.5.10
sambasamba3.5.11
sambasamba3.5.12
sambasamba3.5.13
sambasamba3.5.14
sambasamba3.5.15
sambasamba3.5.16
sambasamba3.5.17
sambasamba3.5.18
sambasamba3.5.19
sambasamba3.5.20
sambasamba3.5.21
sambasamba3.5.22
sambasamba3.6.0
sambasamba3.6.1
sambasamba3.6.2
sambasamba3.6.10
sambasamba3.6.11
sambasamba3.6.12
sambasamba3.6.13
sambasamba3.6.14
sambasamba3.6.15
sambasamba3.6.16
sambasamba3.6.17
sambasamba3.6.18
sambasamba3.6.19
sambasamba3.6.20
sambasamba3.6.21
sambasamba3.6.22
sambasamba3.6.23
sambasamba3.6.24
sambasamba4.0.0
sambasamba4.0.1
sambasamba4.0.2
sambasamba4.0.3
sambasamba4.0.4
sambasamba4.0.5
sambasamba4.0.6
sambasamba4.0.7
sambasamba4.0.8
sambasamba4.0.9
sambasamba4.0.10
sambasamba4.0.11
sambasamba4.0.12
sambasamba4.0.13
sambasamba4.0.14
sambasamba4.0.15
sambasamba4.0.16
sambasamba4.0.17
sambasamba4.0.18
sambasamba4.0.19
sambasamba4.0.20
sambasamba4.0.21
sambasamba4.0.22
sambasamba4.0.23
sambasamba4.0.24
sambasamba4.1.0
sambasamba4.1.1
sambasamba4.1.2
sambasamba4.1.3
sambasamba4.1.4
sambasamba4.1.5
sambasamba4.1.6
sambasamba4.1.7
sambasamba4.1.8
sambasamba4.1.9
sambasamba4.1.10
sambasamba4.1.11
sambasamba4.1.12
sambasamba4.1.13
sambasamba4.1.14
sambasamba4.1.15
sambasamba4.1.16
sambasamba4.2.0

References

CWEs

CWE-17

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.