CVE-2007-6015

Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.

🔗 References (114)

• PSIRT-CNA@flexerasoftwarehttp://bugs.gentoo.org/show_bug.cgi?id=200773
• PSIRT-CNA@flexerasoftwarehttp://docs.info.apple.com/article.html?artnum=307430
• PSIRT-CNA@flexerasoftwarehttp://lists.apple.com/archives/security-announce/2008/Feb/msg00002.html
• PSIRT-CNA@flexerasoftwarehttp://lists.vmware.com/pipermail/security-announce/2008/000005.html
• PSIRT-CNA@flexerasoftwarehttp://marc.info/?l=bugtraq&m=120524782005154&w=2
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/27760
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/27894
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/27977
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/27993
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/27999
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/28003
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/28028
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/28029
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/28037
• PSIRT-CNA@flexerasoftwarehttp://secunia.com/advisories/28067