HIGH
Samba client buffer overflow
Published May 29, 2008
7.5
HIGHCVSS 2.0
EPSS 69.08%
Description
Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response.
Affected products
No data.
Configuration 2
OR
- 6.06
- 7.04
- 7.10
- 8.04
Configuration 3
- 4.0
No data.
Red Hat Enterprise Linux 2.1
samba-0:2.2.12-1.21as.9.3
Fixed · RHSA-2008:0288
Red Hat Enterprise Linux 3
samba-0:3.0.9-1.3E.15
Fixed · RHSA-2008:0288
Red Hat Enterprise Linux 4
samba-0:3.0.25b-1.el4_6.5
Fixed · RHSA-2008:0288
Red Hat Enterprise Linux 4.5 Z Stream
samba-0:3.0.10-2.el4_5.3
Fixed · RHSA-2008:0289
Red Hat Enterprise Linux 5
samba-0:3.0.28-1.el5_2.1
Fixed · RHSA-2008:0290
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 2.1 | samba-0:2.2.12-1.21as.9.3 | Fixed | RHSA-2008:0288 |
| Red Hat Enterprise Linux 3 | samba-0:3.0.9-1.3E.15 | Fixed | RHSA-2008:0288 |
| Red Hat Enterprise Linux 4 | samba-0:3.0.25b-1.el4_6.5 | Fixed | RHSA-2008:0288 |
| Red Hat Enterprise Linux 4.5 Z Stream | samba-0:3.0.10-2.el4_5.3 | Fixed | RHSA-2008:0289 |
| Red Hat Enterprise Linux 5 | samba-0:3.0.28-1.el5_2.1 | Fixed | RHSA-2008:0290 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
7.5 HIGH NVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
69.08% 0.69085
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.69085
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (24 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 69.08% (0.69085) | 99.34th | v5 (v2026.06.15) |
| Jun 15, 2026 | 69.08% (0.69085) | 99.27th | v5 (v2026.06.15) |
| Mar 18, 2026 | 85.73% (0.85727) | 99.37th | v4 (v2025.03.14) |
| Nov 30, 2025 | 88.15% (0.88153) | 99.45th | v4 (v2025.03.14) |
| Oct 23, 2025 | 78.86% (0.78858) | 99.01th | v4 (v2025.03.14) |
| Oct 22, 2025 | 75.31% (0.75308) | 98.82th | v4 (v2025.03.14) |
| Oct 19, 2025 | 71.93% (0.71931) | 98.67th | v4 (v2025.03.14) |
| Aug 31, 2025 | 72.95% (0.72947) | 98.73th | v4 (v2025.03.14) |
| Aug 30, 2025 | 75.31% (0.75308) | 98.84th | v4 (v2025.03.14) |
| Mar 30, 2025 | 91.26% (0.91259) | 99.64th | v4 (v2025.03.14) |
| Mar 29, 2025 | 89.52% (0.89520) | 99.47th | v4 (v2025.03.14) |
| Mar 17, 2025 | 91.26% (0.91259) | 99.64th | v4 (v2025.03.14) |
| Dec 12, 2024 | 96.88% (0.96881) | 99.76th | v3 (v2023.03.01) |
| Nov 2, 2023 | 97.02% (0.97018) | 99.66th | v3 (v2023.03.01) |
| Sep 26, 2023 | 96.80% (0.96802) | 99.56th | v3 (v2023.03.01) |
| Aug 23, 2023 | 96.63% (0.96631) | 99.46th | v3 (v2023.03.01) |
| Jul 19, 2023 | 97.14% (0.97140) | 99.68th | v3 (v2023.03.01) |
| Jun 12, 2023 | 97.12% (0.97120) | 99.65th | v3 (v2023.03.01) |
| May 6, 2023 | 97.09% (0.97094) | 99.62th | v3 (v2023.03.01) |
| Mar 29, 2023 | 97.02% (0.97024) | 99.56th | v3 (v2023.03.01) |
| Mar 7, 2023 | 96.97% (0.96972) | 99.51th | v3 (v2023.03.01) |
| Mar 6, 2023 | 18.60% (0.18601) | 96.34th | v2 (v2022.01.01) |
| Apr 1, 2022 | 18.60% (0.18601) | 96.01th | v2 (v2022.01.01) |
| Feb 4, 2022 | 18.60% (0.18601) | 93.64th | v2 (v2022.01.01) |
Weaknesses (1)
References (56)
- http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00000.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2008/000023.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://secunia.com/advisories/30228 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30385 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30396 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30442 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30449 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30478 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30489 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30543 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30736 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30802 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/30835 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/31246 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/31911 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/advisories/33696 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://secunia.com/secunia_research/2008-20/advisory/ x_refsource_MISCThird Party AdvisoryVendor Advisory
- http://security.gentoo.org/glsa/glsa-200805-23.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://securitytracker.com/id?1020123 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473951 vendor-advisoryx_refsource_SLACKWAREMailing ListThird Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-249086-1 vendor-advisoryx_refsource_SUNALERTBroken Link
- http://support.apple.com/kb/HT2163 x_refsource_CONFIRMThird Party Advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0180 x_refsource_CONFIRMBroken Link
- http://www.debian.org/security/2008/dsa-1590 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:108 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.redhat.com/support/errata/RHSA-2008-0288.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0289.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0290.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.samba.org/samba/security/CVE-2008-1105.html x_refsource_CONFIRMVendor Advisory
- http://www.securityfocus.com/archive/1/492683/100/0/threaded mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/492737/100/0/threaded mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/492903/100/0/threaded mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/29404 vdb-entryx_refsource_BIDPatchThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/31255 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/usn-617-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.ubuntu.com/usn/usn-617-2 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.vupen.com/english/advisories/2008/1681 vdb-entryx_refsource_VUPENPermissions Required
- http://www.vupen.com/english/advisories/2008/1908 vdb-entryx_refsource_VUPENPermissions Required
- http://www.vupen.com/english/advisories/2008/1981/references vdb-entryx_refsource_VUPENPermissions Required
- http://www.vupen.com/english/advisories/2008/2222/references vdb-entryx_refsource_VUPENPermissions Required
- http://www.vupen.com/english/advisories/2008/2639 vdb-entryx_refsource_VUPENPermissions Required
- http://www.xerox.com/downloads/usa/en/c/cert_XRX08_009.pdf x_refsource_CONFIRMBroken Link
- http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01475657 vendor-advisoryx_refsource_HPBroken Link
- https://access.redhat.com/security/cve/CVE-2008-1105 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=446724 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42664 vdb-entryx_refsource_XFVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45251 vdb-entryx_refsource_XFVDB Entry
- https://nvd.nist.gov/vuln/detail/CVE-2008-1105
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10020 vdb-entrysignaturex_refsource_OVALThird Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5733 vdb-entrysignaturex_refsource_OVALThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2008-1105
- https://www.exploit-db.com/exploits/5712 exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg01006.html vendor-advisoryx_refsource_FEDORAThird Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg01030.html vendor-advisoryx_refsource_FEDORAThird Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg01082.html vendor-advisoryx_refsource_FEDORAThird Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner flexera
Published May 29, 2008
Updated Aug 7, 2024
Reserved Feb 29, 2008
Link CVE-2008-1105
CISA Vulnrichment
Updated n/a