CVE-2013-4124

NameCVE-2013-4124
DescriptionInteger overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
samba (PTS)buster, buster (security)2:4.9.5+dfsg-5+deb10u3fixed
bullseye2:4.13.13+dfsg-1~deb11u4fixed
bullseye (security)2:4.13.13+dfsg-1~deb11u3fixed
bookworm, sid2:4.16.4+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sambasourcesqueeze2:3.5.6~dfsg-3squeeze10
sambasourcewheezy2:3.6.6-6+deb7u1
sambasource(unstable)2:3.6.17-1low
samba4sourcewheezy4.0.0~beta2+dfsg1-3.2+deb7u1
samba4source(unstable)(unfixed)low

Notes

https://www.samba.org/samba/security/CVE-2013-4124
samba as per 2:4.0.9+dfsg-2 is the first upload of the unified samba 4.x package to unstable.
Issue also fixed in 4.0.8 upstream, thus the fix still contained in 4.x in unstable

Search for package or bug name: Reporting problems