CVE-2007-6015

Samba 3.0.0-3.0.27a - Stack-based Buffer Overflow via Long GETDC String in SAMLOGON Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-6015. PoCs published by x86.

AI-analyzed exploit summary This PoC exploits CVE-2007-6015 by sending a crafted SAMLOGON packet via UDP to trigger a buffer overflow in Samba's domain logon support. It targets the NetBIOS name service and is designed to crash the service, with potential for arbitrary code execution.

Description

Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.

Exploits (1)

exploitdb WORKING POC VERIFIED
by x86 · cdoslinux
https://www.exploit-db.com/exploits/4732

This PoC exploits CVE-2007-6015 by sending a crafted SAMLOGON packet via UDP to trigger a buffer overflow in Samba's domain logon support. It targets the NetBIOS name service and is designed to crash the service, with potential for arbitrary code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Samba (with domain logon support enabled)
No auth needed
Prerequisites: Network access to the target · Samba with domain logon support enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (57)

Core 57
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-1117.html
Vendor Advisory x_refsource_confirm
http://docs.info.apple.com/article.html?artnum=307430
Various Sources mailing-list x_refsource_mlist
http://lists.vmware.com/pipermail/security-announce/2008/000005.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28891
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1019295.1-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30835
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29341
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=120524782005154&w=2
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/438395
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/26791
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-238251-1
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_68_samba.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-556-1
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1908
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0495/references
Various Sources vendor-advisory x_refsource_hp
http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01475657
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27999
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/485144/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30484
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29032
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27993
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/38965
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1427
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/488457/100/0/threaded
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:244
Issue Tracking x_refsource_confirm
http://bugs.gentoo.org/show_bug.cgi?id=200773
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/484818/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1019065
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27977
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0637
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28029
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/4153
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28089
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28003
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-1976
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA08-043B.html
Patch vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-1114.html
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3438
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27894
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2008/Feb/msg00002.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27760
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1712/references
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28067
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28037
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0859/references
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/484825/100/0/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/484827/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11572
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28028
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5605
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200712-10.xml

Scores

EPSS 0.2748
EPSS Percentile 97.8%

Details

CWE
CWE-119
Status published
Products (50)
samba/samba 2.0.1
samba/samba 2.0.2
samba/samba 2.0.3
samba/samba 2.0.4
samba/samba 2.0.5
samba/samba 2.0.6
samba/samba 2.0.7
samba/samba 2.0.8
samba/samba 2.0.9
samba/samba 2.0.10
... and 40 more
Published Dec 13, 2007
Tracked Since Feb 18, 2026