CVE-2012-1182

Published: 10 April 2012

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.

Notes

in hardy, the 3.0 reproducer leads to a glibc backtrace

Status

References

• https://www.samba.org/samba/security/CVE-2012-1182
• https://ubuntu.com/security/notices/USN-1423-1
• https://www.cve.org/CVERecord?id=CVE-2012-1182
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.samba.org/show_bug.cgi?id=8815
• https://bugs.launchpad.net/bugs/978458