Vulnerability Details : CVE-2015-5370
Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.
Vulnerability category: Execute codeDenial of service
Products affected by CVE-2015-5370
- cpe:2.3:a:samba:samba:3.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.20:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.18:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.17:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.16:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.15:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.19:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.21:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.22:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.23:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.23:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.24:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.24:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.21:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.20:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.19:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.26:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.25:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.23:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.22:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:3.6.25:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.2.7:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-5370
1.85%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-5370
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
2.2
|
3.6
|
NIST |
References for CVE-2015-5370
-
https://www.samba.org/samba/latest_news.html#4.4.2
Samba - Latest News
-
http://www.ubuntu.com/usn/USN-2950-2
USN-2950-2: libsoup update | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html
[security-announce] SUSE-SU-2016:1022-1: important: Security update for
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html
[SECURITY] Fedora 24 Update: samba-4.4.2-1.fc24
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
[security-announce] openSUSE-SU-2016:1064-1: important: Security update
-
http://rhn.redhat.com/errata/RHSA-2016-0624.html
RHSA-2016:0624 - Security Advisory - Red Hat Customer Portal
-
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012
The Slackware Linux Project: Slackware Security Advisories
-
http://www.ubuntu.com/usn/USN-2950-4
USN-2950-4: Samba regressions | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2016-0612.html
RHSA-2016:0612 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html
[security-announce] SUSE-SU-2016:1023-1: important: Security update for
-
https://www.samba.org/samba/history/samba-4.2.10.html
Samba - Release Notes Archive
-
http://badlock.org/
Open Source SMB & AD
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
[SECURITY] Fedora 22 Update: samba-4.2.11-0.fc22
-
https://bto.bluecoat.com/security-advisory/sa122
SA122 : SMB Vulnerabilities in Windows and Samba (Badlock)
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
Oracle Linux Bulletin - April 2016
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html
[security-announce] SUSE-SU-2016:1028-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2016-0613.html
RHSA-2016:0613 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2016-0611.html
RHSA-2016:0611 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
[security-announce] openSUSE-SU-2016:1106-1: important: Security update
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html
[security-announce] SUSE-SU-2016:1024-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2016-0619.html
RHSA-2016:0619 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2016-0614.html
RHSA-2016:0614 - Security Advisory - Red Hat Customer Portal
-
http://www.debian.org/security/2016/dsa-3548
Debian -- Security Information -- DSA-3548-1 samba
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05162399
HPSBUX03616 SSRT110128 rev.2 - HPE HP-UX running CIFS Server (Samba), Remote Denial of Service (DoS), Disclosure of Information, Unauthorized Access
-
https://www.samba.org/samba/security/CVE-2015-5370.html
Samba - Security Announcement ArchivePatch;Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-0618.html
RHSA-2016:0618 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2016-0620.html
RHSA-2016:0620 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html
[security-announce] openSUSE-SU-2016:1025-1: important: Security update
-
http://www.ubuntu.com/usn/USN-2950-5
USN-2950-5: Samba regression | Ubuntu security notices
-
http://www.securitytracker.com/id/1035533
Samba Multiple Flaws Let Remote Users Hijack Connections, Obtain Potentially Sensitive Information, and Deny Service - SecurityTracker
-
http://www.ubuntu.com/usn/USN-2950-3
USN-2950-3: Samba regressions | Ubuntu security notices
-
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html
[SECURITY] Fedora 23 Update: samba-4.3.8-0.fc23
-
http://www.ubuntu.com/usn/USN-2950-1
USN-2950-1: Samba vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html
[security-announce] openSUSE-SU-2016:1107-1: important: Security update
Jump to