Search for vulnerabilities
| Vulnerability ID | VCID-ca53-vmpv-aaaf |
| Aliases |
CVE-2012-1182
|
| Summary | The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 9.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| CWE-189 | Numeric Errors |
| CWE-228 | Improper Handling of Syntactically Invalid Structure |
| CWE-122 | Heap-based Buffer Overflow |
| Data source | Exploit-DB |
|---|---|
| Date added | Oct. 10, 2012 |
| Description | Samba 3.4.16/3.5.14/3.6.4 - SetInformationPolicy AuditEventsInfo Heap Overflow (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | Oct. 10, 2012 |
| Exploit type | remote |
| Platform | linux |
| Source update date | Dec. 1, 2016 |
| Source URL | http://www.zerodayinitiative.com/advisories/ZDI-12-069/ |
| Data source | Metasploit |
|---|---|
| Description | This module triggers a vulnerability in the LSA RPC service of the Samba daemon because of an error on the PIDL auto-generated code. Making a specially crafted call to SetInformationPolicy to set a PolicyAuditEventsInformation allows to trigger a heap overflow and finally execute arbitrary code with root privileges. The module uses brute force to guess the stackpivot/rop chain or the system() address and redirect flow there in order to bypass NX. The start and stop addresses for brute forcing have been calculated empirically. On the other hand the module provides the StartBrute and StopBrute which allow the user to configure his own addresses. |
| Note | Stability: - crash-service-restarts Reliability: - unreliable-session SideEffects: - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | April 10, 2012 |
| Platform | Linux,Unix |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/samba/setinfopolicy_heap.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.98815 |
| EPSS Score | 0.75225 |
| Published At | March 30, 2025, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| There are no relevant records. | ||||