CVE-2013-4124
Samba 3.x-3.5.21, 3.6.x-3.6.16, 4.x-4.0.7 - Denial of Service via Malformed NTTRANS Packet
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-4124.
PoCs published by x90c, Jeremy Allison, dz_lnly, including Metasploit module auxiliary/dos/samba/read_nttrans_ea_list.
AI-analyzed exploit summary This exploit targets an integer overflow vulnerability in Samba's NTTRANS reply handling, specifically in the `read_nttrans_ea_list` function. It sends a malformed SMB packet with a large offset value to trigger an integer wrap, leading to a remote denial-of-service (DoS).
Description
Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.
Exploits (2)
This exploit targets an integer overflow vulnerability in Samba's NTTRANS reply handling, specifically in the `read_nttrans_ea_list` function. It sends a malformed SMB packet with a large offset value to trigger an integer wrap, leading to a remote denial-of-service (DoS).
This Metasploit module exploits an integer overflow in Samba's read_nttrans_ea_list function (CVE-2013-4124) by sending malformed packets to trigger a denial-of-service (memory exhaustion). It requires the 'ea support' option to be enabled on the target share.