CVE-2010-2063
Samba 3.0.0-3.3.12 - Remote Code Execution via SMB1 Packet Chaining
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-2063.
PoCs published by Metasploit, Jun Mao, jduck, including Metasploit module exploits/linux/samba/chain_reply.
AI-analyzed exploit summary This exploit targets a memory corruption vulnerability in Samba versions prior to 3.3.13, specifically on Linux x86 systems without NX memory protection. It leverages a chained response packet to overwrite a talloc chunk destructor function pointer, achieving remote code execution.
Description
Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted field in a packet.
Exploits (2)
This exploit targets a memory corruption vulnerability in Samba versions prior to 3.3.13, specifically on Linux x86 systems without NX memory protection. It leverages a chained response packet to overwrite a talloc chunk destructor function pointer, achieving remote code execution.
This Metasploit module exploits a memory corruption vulnerability in Samba versions prior to 3.3.13 by manipulating the 'chain_reply' mechanism to overwrite a talloc chunk destructor function pointer, achieving remote code execution on x86 Linux systems without NX protection.