CVE-2012-1182
Samba < 3.4.16, 3.5.x < 3.5.14, 3.6.x < 3.6.4 - Remote Code Execution via RPC Array Length Validation Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-1182.
PoCs published by Metasploit, Unknown, blasty, mephos, sinn3r, juan vazquez, including Metasploit module exploits/linux/samba/setinfopolicy_heap.
AI-analyzed exploit summary This Metasploit module exploits a heap overflow in Samba's LSA RPC service (CVE-2012-1182) by brute-forcing the system() address to bypass NX and achieve remote code execution with root privileges.
Description
The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.
Exploits (2)
This Metasploit module exploits a heap overflow in Samba's LSA RPC service (CVE-2012-1182) by brute-forcing the system() address to bypass NX and achieve remote code execution with root privileges.
This Metasploit module exploits a heap overflow in Samba's LSA RPC service (CVE-2012-1182) via a crafted SetInformationPolicy call, using brute-force to bypass NX and achieve remote code execution with root privileges.