CVE-2007-0452: Medium severity Samba Samba vulnerability

Published Feb 6, 2007

Updated

smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.

Affected Software

22 affected components

Samba Samba=3.0.14a

Samba Samba=3.0.8

Samba Samba=3.0.6

Samba Samba=3.0.21a

Samba Samba=3.0.23

Samba Samba=3.0.20a

Samba Samba=3.0.21b

Samba Samba=3.0.9

Samba Samba=3.0.11

Samba Samba=3.0.7

Samba Samba=3.0.13

Samba Samba=3.0.20b

Samba Samba=3.0.21

Samba Samba=3.0.21c

Samba Samba=3.0.23b

Samba Samba=3.0.12

Samba Samba=3.0.20

Samba Samba=3.0.10

Samba Samba=3.0.23d

Samba Samba=3.0.23c

Samba Samba=3.0.23a

Samba Samba=3.0.22

Event History

Feb 6, 2007

CVE Published

02:28 AM

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0452?

CVE-2007-0452 is classified as a moderate severity vulnerability due to its potential to cause denial of service.

How do I fix CVE-2007-0452?

To fix CVE-2007-0452, upgrade to a Samba version that is not affected, such as Samba 3.0.24 or later.

What versions of Samba are affected by CVE-2007-0452?

CVE-2007-0452 affects Samba versions from 3.0.6 through 3.0.23d.

What type of attack does CVE-2007-0452 facilitate?

CVE-2007-0452 allows remote authenticated users to conduct a denial of service attack by causing memory and CPU exhaustion.

Can CVE-2007-0452 be exploited remotely?

Yes, CVE-2007-0452 can be exploited remotely by authenticated users through the Samba service.