CVE-2015-0240
Samba _netr_ServerPasswordSet Uninitialized Credential State
Title source: metasploitExploitation Summary
EIP tracks 2 public exploits for CVE-2015-0240.
PoCs published by sleepya, Richard van Eeden, sleepya, sinn3r, including Metasploit module auxiliary/scanner/smb/smb_uninit_cred.
AI-analyzed exploit summary This exploit targets CVE-2015-0240, a heap-based buffer overflow in Samba versions prior to 3.6.24. It leverages the uninitialized 'creds' variable controlled by the ReferentID field in the PrimaryName structure to achieve remote code execution on vulnerable x86 systems.
Description
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.
Exploits (2)
This exploit targets CVE-2015-0240, a heap-based buffer overflow in Samba versions prior to 3.6.24. It leverages the uninitialized 'creds' variable controlled by the ReferentID field in the PrimaryName structure to achieve remote code execution on vulnerable x86 systems.
This Metasploit module exploits CVE-2015-0240, an uninitialized credential state vulnerability in Samba's _netr_ServerPasswordSet function. It includes both passive version checking and an active exploit that triggers a segmentation fault in vulnerable Samba versions.