CVE-2010-1635: Null Pointer Dereference
It was reported [1] that two vulnerabilities were found in Samba's smbd that would allow an attacker to trigger a null pointer dereference or an unitialized variable read by sending a specific 'Sessions Setup AndX' query. Successful exploitation of these issues would result in a denial of service. The upstream bug report [2] has a patch.
[1] http://www.stratsec.net/Research/Advisories/Samba-Multiple-DoS-Vulnerabilities-(SS-2010-005) [2] https://bugzilla.samba.org/showbug.cgi?id=7254
Other sources
The chainreply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1635?
CVE-2010-1635 is classified as a denial of service vulnerability.
How do I fix CVE-2010-1635?
To fix CVE-2010-1635, update Samba to version 3.5.2 or later.
What versions of Samba are affected by CVE-2010-1635?
CVE-2010-1635 affects Samba versions up to and including 3.4.7 and several 3.0.x versions.
Is CVE-2010-1635 remotely exploitable?
Yes, CVE-2010-1635 can be exploited remotely by sending specially crafted requests to the Samba server.
What is the impact of successfully exploiting CVE-2010-1635?
Successful exploitation of CVE-2010-1635 can lead to a denial of service, causing the affected Samba service to crash.