CVE-2013-4124

Published: Aug 6, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.

Affected (177)

Products: Canonical: Ubuntu Linux · Redhat: Enterprise Linux · Fedoraproject: Fedora · +2 more

Show all products

Canonical: Ubuntu Linux · Redhat: Enterprise Linux · Fedoraproject: Fedora · Samba: Samba · Opensuse: Opensuse

1 product

1 product

1 product

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.04

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 18
Fedoraproject Fedora	Version 19

Configuration D

168 vulnerable

Vulnerable Software	Affected Versions
Samba Samba	Version 3.0.0
Samba Samba	Version 3.0.10
Samba Samba	Version 3.0.11
Samba Samba	Version 3.0.12
Samba Samba	Version 3.0.13
Samba Samba	Version 3.0.14
Samba Samba	Version 3.0.14 a
Samba Samba	Version 3.0.14a
Samba Samba	Version 3.0.15
Samba Samba	Version 3.0.16
Samba Samba	Version 3.0.17
Samba Samba	Version 3.0.18
Samba Samba	Version 3.0.19
Samba Samba	Version 3.0.1
Samba Samba	Version 3.0.20
Samba Samba	Version 3.0.20 a
Samba Samba	Version 3.0.20 b
Samba Samba	Version 3.0.20a
Samba Samba	Version 3.0.20b
Samba Samba	Version 3.0.21
Samba Samba	Version 3.0.21 a
Samba Samba	Version 3.0.21 b
Samba Samba	Version 3.0.21 c
Samba Samba	Version 3.0.21a
Samba Samba	Version 3.0.21b
Samba Samba	Version 3.0.21c
Samba Samba	Version 3.0.22
Samba Samba	Version 3.0.23
Samba Samba	Version 3.0.23 a
Samba Samba	Version 3.0.23 b
Samba Samba	Version 3.0.23 c
Samba Samba	Version 3.0.23 d
Samba Samba	Version 3.0.23a
Samba Samba	Version 3.0.23b
Samba Samba	Version 3.0.23c
Samba Samba	Version 3.0.23d
Samba Samba	Version 3.0.24
Samba Samba	Version 3.0.25
Samba Samba	Version 3.0.25 a
Samba Samba	Version 3.0.25 b
Samba Samba	Version 3.0.25 c
Samba Samba	Version 3.0.25 pre1
Samba Samba	Version 3.0.25 pre2
Samba Samba	Version 3.0.25 rc1
Samba Samba	Version 3.0.25 rc2
Samba Samba	Version 3.0.25 rc3
Samba Samba	Version 3.0.25a
Samba Samba	Version 3.0.25b
Samba Samba	Version 3.0.25c
Samba Samba	Version 3.0.26
Samba Samba	Version 3.0.26 a
Samba Samba	Version 3.0.26a
Samba Samba	Version 3.0.27
Samba Samba	Version 3.0.27 a
Samba Samba	Version 3.0.28
Samba Samba	Version 3.0.28 a
Samba Samba	Version 3.0.29
Samba Samba	Version 3.0.2
Samba Samba	Version 3.0.2 a
Samba Samba	Version 3.0.2a
Samba Samba	Version 3.0.30
Samba Samba	Version 3.0.31
Samba Samba	Version 3.0.32
Samba Samba	Version 3.0.33
Samba Samba	Version 3.0.34
Samba Samba	Version 3.0.35
Samba Samba	Version 3.0.36
Samba Samba	Version 3.0.37
Samba Samba	Version 3.0.3
Samba Samba	Version 3.0.4
Samba Samba	Version 3.0.4 rc1
Samba Samba	Version 3.0.5
Samba Samba	Version 3.0.6
Samba Samba	Version 3.0.7
Samba Samba	Version 3.0.8
Samba Samba	Version 3.0.9
Samba Samba	Version 3.1.0
Samba Samba	Version 3.2.0
Samba Samba	Version 3.2.10
Samba Samba	Version 3.2.11
Samba Samba	Version 3.2.12
Samba Samba	Version 3.2.13
Samba Samba	Version 3.2.14
Samba Samba	Version 3.2.15
Samba Samba	Version 3.2.1
Samba Samba	Version 3.2.2
Samba Samba	Version 3.2.3
Samba Samba	Version 3.2.4
Samba Samba	Version 3.2.5
Samba Samba	Version 3.2.6
Samba Samba	Version 3.2.7
Samba Samba	Version 3.2.8
Samba Samba	Version 3.2.9
Samba Samba	Version 3.3.0
Samba Samba	Version 3.3.10
Samba Samba	Version 3.3.11
Samba Samba	Version 3.3.12
Samba Samba	Version 3.3.13
Samba Samba	Version 3.3.14
Samba Samba	Version 3.3.15
Samba Samba	Version 3.3.16
Samba Samba	Version 3.3.1
Samba Samba	Version 3.3.2
Samba Samba	Version 3.3.3
Samba Samba	Version 3.3.4
Samba Samba	Version 3.3.5
Samba Samba	Version 3.3.6
Samba Samba	Version 3.3.7
Samba Samba	Version 3.3.8
Samba Samba	Version 3.3.9
Samba Samba	Version 3.4.0
Samba Samba	Version 3.4.10
Samba Samba	Version 3.4.11
Samba Samba	Version 3.4.12
Samba Samba	Version 3.4.13
Samba Samba	Version 3.4.14
Samba Samba	Version 3.4.15
Samba Samba	Version 3.4.16
Samba Samba	Version 3.4.17
Samba Samba	Version 3.4.1
Samba Samba	Version 3.4.2
Samba Samba	Version 3.4.3
Samba Samba	Version 3.4.4
Samba Samba	Version 3.4.5
Samba Samba	Version 3.4.6
Samba Samba	Version 3.4.7
Samba Samba	Version 3.4.8
Samba Samba	Version 3.4.9
Samba Samba	Version 3.5.0
Samba Samba	Version 3.5.10
Samba Samba	Version 3.5.11
Samba Samba	Version 3.5.12
Samba Samba	Version 3.5.13
Samba Samba	Version 3.5.14
Samba Samba	Version 3.5.15
Samba Samba	Version 3.5.16
Samba Samba	Version 3.5.17
Samba Samba	Version 3.5.18
Samba Samba	Version 3.5.19
Samba Samba	Version 3.5.1
Samba Samba	Version 3.5.20
Samba Samba	Version 3.5.21
Samba Samba	Version 3.5.2
Samba Samba	Version 3.6.0
Samba Samba	Version 3.6.10
Samba Samba	Version 3.6.11
Samba Samba	Version 3.6.12
Samba Samba	Version 3.6.13
Samba Samba	Version 3.6.14
Samba Samba	Version 3.6.15
Samba Samba	Version 3.6.16
Samba Samba	Version 3.6.1
Samba Samba	Version 3.6.2
Samba Samba	Version 3.6.3
Samba Samba	Version 3.6.4
Samba Samba	Version 3.6.5
Samba Samba	Version 3.6.6
Samba Samba	Version 3.6.7
Samba Samba	Version 3.6.8
Samba Samba	Version 3.6.9
Samba Samba	Version 4.0.0
Samba Samba	Version 4.0.1
Samba Samba	Version 4.0.2
Samba Samba	Version 4.0.3
Samba Samba	Version 4.0.4
Samba Samba	Version 4.0.5
Samba Samba	Version 4.0.6
Samba Samba	Version 4.0.7

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 12.2
Opensuse Opensuse	Version 12.3

Related CWEs

CWE-189

References (48)

http://archives.neohapsis.com/archives/bugtraq/2013-08/0028.html

Source: secalert@redhat.com

http://ftp.samba.org/pub/samba/patches/security/samba-4.0.7-CVE-2013-4124.patch

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113591.html

Source: secalert@redhat.com

Vendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114011.html

Source: secalert@redhat.com

Vendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00012.html

Source: secalert@redhat.com

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00015.html

Source: secalert@redhat.com

Vendor Advisory

http://marc.info/?l=bugtraq&m=141660010015249&w=2

Source: secalert@redhat.com

http://osvdb.org/95969

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1310.html

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1542.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1543.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0305.html

Source: secalert@redhat.com

http://secunia.com/advisories/54519

Source: secalert@redhat.com

Vendor Advisory

http://security.gentoo.org/glsa/glsa-201502-15.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2013:207

Source: secalert@redhat.com

http://www.samba.org/samba/history/samba-3.5.22.html

Source: secalert@redhat.com

Vendor Advisory

http://www.samba.org/samba/history/samba-3.6.17.html

Source: secalert@redhat.com

Vendor Advisory

http://www.samba.org/samba/history/samba-4.0.8.html

Source: secalert@redhat.com

Vendor Advisory

http://www.samba.org/samba/security/CVE-2013-4124

Source: secalert@redhat.com

Vendor Advisory

http://www.securitytracker.com/id/1028882

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1966-1

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=984401

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/86185

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2013-08/0028.html