CVE-2008-1105 in the critical feed json
Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute…
published 2008-05-29 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-1114
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 69.1%
- EPSS 69.1% chance of exploitation in 30 days, percentile 99.3%
- public exploits
- 1
- Exploit-DB
Summary
Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response.
Patch / fix
- samba Debian 14, Debian 13, Debian 12 1:3.0.30-1
debian advisories DEBIAN-CVE-2008-1105
- samba RHEL 5 3.0.28-1.el5_2.1
- samba-swat RHEL 5 3.0.28-1.el5_2.1
- samba-client RHEL 5 3.0.28-1.el5_2.1
- samba-common RHEL 5 3.0.28-1.el5_2.1
- samba RHEL 2.1 2.2.12-1.21as.9.3
- samba RHEL 3 3.0.9-1.3E.15
- samba RHEL 4 3.0.25b-1.el4_6.5
- samba-swat RHEL 2.1 2.2.12-1.21as.9.3
red hat advisories RHSA-2008:0290RHSA-2008:0289RHSA-2008:0288
- cifs-utils openSUSE Tumbleweed 6.13-1.3
- samba openSUSE Tumbleweed 4.14.6+git.182.2205d5224e3-1.1
opensuse advisories openSUSE-SU-2024:10683-1openSUSE-SU-2024:11365-1
- securityfocus.com/bid/29404 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2008-1105 updated
Samba client buffer overflow
-
Red Hat Desktop version 3 samba 3.0.9-1.3E.15, samba-swat 3.0.9-1.3E.15, samba-client 3.0.9-1.3E.15, samba-common 3.0.9-1.3E.15fixed: vendor fix RHSA-2008:0288
-
Red Hat Enterprise Linux (v. 5 server) samba 3.0.28-1.el5_2.1, samba-swat 3.0.28-1.el5_2.1, samba-client 3.0.28-1.el5_2.1, samba-common 3.0.28-1.el5_2.1fixed: vendor fix RHSA-2008:0290
-
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 samba 2.2.12-1.21as.9.3, samba-swat 2.2.12-1.21as.9.3, samba-client 2.2.12-1.21as.9.3, samba-common 2.2.12-1.21as.9.3fixed: vendor fix RHSA-2008:0288
-
Red Hat Enterprise Linux AS EUS (v. 4.5) samba 3.0.10-2.el4_5.3, samba-swat 3.0.10-2.el4_5.3, samba-client 3.0.10-2.el4_5.3, samba-common 3.0.10-2.el4_5.3fixed: vendor fix RHSA-2008:0289
-
Red Hat Enterprise Linux AS version 3 samba 3.0.9-1.3E.15, samba-swat 3.0.9-1.3E.15, samba-client 3.0.9-1.3E.15, samba-common 3.0.9-1.3E.15 Red Hat Enterprise Linux AS version 4 samba 3.0.25b-1.el4_6.5, samba-swat 3.0.25b-1.el4_6.5, samba-client 3.0.25b-1.el4_6.5, samba-common 3.0.25b-1.el4_6.5fixed: vendor fix RHSA-2008:0288
-
Red Hat Enterprise Linux Desktop (v. 5 client) samba 3.0.28-1.el5_2.1, samba-swat 3.0.28-1.el5_2.1, samba-client 3.0.28-1.el5_2.1, samba-common 3.0.28-1.el5_2.1fixed: vendor fix RHSA-2008:0290
-
Red Hat Enterprise Linux Desktop version 4 samba 3.0.25b-1.el4_6.5, samba-swat 3.0.25b-1.el4_6.5, samba-client 3.0.25b-1.el4_6.5, samba-common 3.0.25b-1.el4_6.5fixed: vendor fix RHSA-2008:0288
-
Red Hat Enterprise Linux ES EUS (v. 4.5) samba 3.0.10-2.el4_5.3, samba-swat 3.0.10-2.el4_5.3, samba-client 3.0.10-2.el4_5.3, samba-common 3.0.10-2.el4_5.3fixed: vendor fix RHSA-2008:0289
show 1 moreshow fewer
-
Red Hat Enterprise Linux ES version 2.1 samba 2.2.12-1.21as.9.3, samba-swat 2.2.12-1.21as.9.3, samba-client 2.2.12-1.21as.9.3, samba-common 2.2.12-1.21as.9.3 Red Hat Enterprise Linux ES version 3 samba 3.0.9-1.3E.15, samba-swat 3.0.9-1.3E.15, samba-client 3.0.9-1.3E.15, samba-common 3.0.9-1.3E.15 Red Hat Enterprise Linux ES version 4 samba 3.0.25b-1.el4_6.5, samba-swat 3.0.25b-1.el4_6.5, samba-client 3.0.25b-1.el4_6.5, samba-common 3.0.25b-1.el4_6.5 Red Hat Enterprise Linux WS version 2.1 samba 2.2.12-1.21as.9.3, samba-swat 2.2.12-1.21as.9.3, samba-client 2.2.12-1.21as.9.3, samba-common 2.2.12-1.21as.9.3 Red Hat Enterprise Linux WS version 3 samba 3.0.9-1.3E.15, samba-swat 3.0.9-1.3E.15, samba-client 3.0.9-1.3E.15, samba-common 3.0.9-1.3E.15 Red Hat Enterprise Linux WS version 4 samba 3.0.25b-1.el4_6.5, samba-swat 3.0.25b-1.el4_6.5, samba-client 3.0.25b-1.el4_6.5, samba-common 3.0.25b-1.el4_6.5fixed: vendor fix RHSA-2008:0288
+1 more productsfewer
Red Hat Linux Advanced Workstation 2.1 samba 2.2.12-1.21as.9.3, samba-swat 2.2.12-1.21as.9.3, samba-client 2.2.12-1.21as.9.3, samba-common 2.2.12-1.21as.9.3
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- First public exploit (EDB-5712)
Exploit prediction
69.08% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-5712 Samba 3.0.29 (Client) - 'receive_smb_raw()' Buffer Overflow (PoC) dos, 2008-06-01
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
securityfocus.com
/bid/29404
patch, third-party-advisory, vdb-entry
-
exploit-db.com
/exploits/5712
exploit
-
redhat.com
/support/errata/RHSA-2008-0288.html
vendor-advisory, third-party-advisory
-
redhat.com
/archives/fedora-package-announce/2008-May/msg01030.html
vendor-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473951
vendor-advisory, mailing-list, third-party-advisory
-
redhat.com
/support/errata/RHSA-2008-0290.html
vendor-advisory, third-party-advisory
-
www11.itrc.hp.com
/service/cki/docDisplay.do?docId=emr_na-c01475657
vendor-advisory
-
lists.apple.com
/archives/security-announce/2008//Jun/msg00002.html
vendor-advisory, mailing-list, third-party-advisory
-
redhat.com
/archives/fedora-package-announce/2008-May/msg01082.html
vendor-advisory
-
redhat.com
/archives/fedora-package-announce/2008-May/msg01006.html
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-26-249086-1
vendor-advisory, broken-link
-
mandriva.com
/security/advisories?name=MDVSA-2008:108
vendor-advisory, broken-link
-
ubuntu.com
/usn/usn-617-2
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/usn-617-1
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/glsa-200805-23.xml
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2008-06/msg00000.html
vendor-advisory, mailing-list, third-party-advisory
-
redhat.com
/support/errata/RHSA-2008-0289.html
vendor-advisory, third-party-advisory
-
debian.org
/security/2008/dsa-1590
vendor-advisory, third-party-advisory
-
secunia.com
/secunia_research/2008-20/advisory/
third-party-advisory, vendor-advisory
-
samba.org
/samba/security/CVE-2008-1105.html
vendor-advisory
-
secunia.com
/advisories/30478
third-party-advisory
-
secunia.com
/advisories/30396
third-party-advisory
-
support.apple.com
/kb/HT2163
third-party-advisory
-
secunia.com
/advisories/30489
third-party-advisory
-
vupen.com
/english/advisories/2008/2639
vdb-entry
-
securitytracker.com
/id?1020123
vdb-entry, third-party-advisory
-
secunia.com
/advisories/30835
third-party-advisory
-
vupen.com
/english/advisories/2008/1981/references
vdb-entry, permissions-required
-
secunia.com
/advisories/30736
third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5733
vdb-entry, signature
-
secunia.com
/advisories/30385
third-party-advisory
-
secunia.com
/advisories/31911
third-party-advisory
-
vupen.com
/english/advisories/2008/1908
vdb-entry, permissions-required
-
exchange.xforce.ibmcloud.com
/vulnerabilities/42664
vdb-entry
-
vupen.com
/english/advisories/2008/2222/references
vdb-entry
-
secunia.com
/advisories/30449
third-party-advisory
-
secunia.com
/advisories/30802
third-party-advisory
-
secunia.com
/advisories/33696
third-party-advisory
-
secunia.com
/advisories/30442
third-party-advisory
-
secunia.com
/advisories/30543
third-party-advisory
-
securityfocus.com
/archive/1/492683/100/0/threaded
mailing-list, third-party-advisory, vdb-entry
-
secunia.com
/advisories/30228
third-party-advisory
- xerox.com /downloads/usa/en/c/cert_XRX08_009.pdf
-
lists.vmware.com
/pipermail/security-announce/2008/000023.html
mailing-list, third-party-advisory
-
secunia.com
/advisories/31246
third-party-advisory
-
wiki.rpath.com
/Advisories:rPSA-2008-0180
broken-link
-
securityfocus.com
/archive/1/492737/100/0/threaded
third-party-advisory, vdb-entry
-
securityfocus.com
/archive/1/492903/100/0/threaded
third-party-advisory, vdb-entry
-
securityfocus.com
/bid/31255
third-party-advisory, vdb-entry
-
vupen.com
/english/advisories/2008/1681
permissions-required
Sources
- CVE List CVE-2008-1105
- NVD CVE-2008-1105
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.