critical
10.0
CVE-2015-0240 in the critical feed json
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x befo…
published 2015-02-24 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-0262
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 88.2%
- EPSS 88.2% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.
Patch / fix
- samba Debian 14, Debian 13, Debian 12 2:4.1.17+dfsg-1
debian advisories DEBIAN-CVE-2015-0240
- samba Ubuntu 14.04 LTS 2:4.1.6+dfsg-1ubuntu2.14.04.7
ubuntu advisories UBUNTU-CVE-2015-0240
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- samba storage 3 3.6.509-169.6.el6rhs
- samba-swat storage 3 3.6.509-169.6.el6rhs
- libsmbclient storage 3 3.6.509-169.6.el6rhs
- samba-client storage 3 3.6.509-169.6.el6rhs
- samba-common storage 3 3.6.509-169.6.el6rhs
- samba-winbind storage 3 3.6.509-169.6.el6rhs
- samba-glusterfs storage 3 3.6.509-169.6.el6rhs
- samba-domainjoin-gui storage 3 3.6.509-169.6.el6rhs
red hat advisories RHSA-2015:0256RHSA-2015:0253RHSA-2015:0254RHSA-2015:0255RHSA-2015:0257RHSA-2015:0252
- samba SLES for SAP 12, SLES 12, SLED 12 +1 more 4.1.12-16.1
suse advisories SUSE-SU-2015:0353-1
- samba openSUSE Tumbleweed 4.5.0-1.1
opensuse advisories openSUSE-SU-2024:10069-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-0240 updated cvss 7.9
samba: talloc free on uninitialized stack pointer in netlogon server could lead to remote-code execution
-
Red Hat Enterprise Linux (v. 5 server) samba3x 3.6.23-9.el5_11, samba3x-swat 3.6.23-9.el5_11, samba3x-client 3.6.23-9.el5_11, samba3x-common 3.6.23-9.el5_11, samba3x-winbind 3.6.23-9.el5_11, samba3x-domainjoin-gui 3.6.23-9.el5_11fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0249
-
Red Hat Enterprise Linux Client (v. 7) samba 4.1.1-38.el7_0, samba-libs 4.1.1-38.el7_0, libwbclient 4.1.1-38.el7_0, libsmbclient 4.1.1-38.el7_0, samba-client 4.1.1-38.el7_0, samba-common 4.1.1-38.el7_0, +2 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.1.1-38.el7_0, samba-dc 4.1.1-38.el7_0, samba-pidl 4.1.1-38.el7_0, samba-test 4.1.1-38.el7_0, samba-python 4.1.1-38.el7_0, samba-dc-libs 4.1.1-38.el7_0, +3 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0252
-
Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) samba 3.6.9-151.el6_4.3, samba-swat 3.6.9-151.el6_4.3, libsmbclient 3.6.9-151.el6_4.3, samba-domainjoin-gui 3.6.9-151.el6_4.3, samba-winbind-krb5-locator 3.6.9-151.el6_4.3 Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5) samba 3.6.9-171.el6_5, samba-swat 3.6.9-171.el6_5, libsmbclient 3.6.9-171.el6_5, samba-domainjoin-gui 3.6.9-171.el6_5, samba-winbind-krb5-locator 3.6.9-171.el6_5fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0254
-
Red Hat Enterprise Linux ComputeNode (v. 7) samba 4.1.1-38.el7_0, samba-libs 4.1.1-38.el7_0, libwbclient 4.1.1-38.el7_0, libsmbclient 4.1.1-38.el7_0, samba-client 4.1.1-38.el7_0, samba-common 4.1.1-38.el7_0, +2 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.1.1-38.el7_0, samba-dc 4.1.1-38.el7_0, samba-pidl 4.1.1-38.el7_0, samba-test 4.1.1-38.el7_0, samba-python 4.1.1-38.el7_0, samba-dc-libs 4.1.1-38.el7_0, +3 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0252
-
Red Hat Enterprise Linux Desktop (v. 5 client) samba3x 3.6.23-9.el5_11, samba3x-swat 3.6.23-9.el5_11, samba3x-client 3.6.23-9.el5_11, samba3x-common 3.6.23-9.el5_11, samba3x-winbind 3.6.23-9.el5_11, samba3x-domainjoin-gui 3.6.23-9.el5_11fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0249
-
Red Hat Enterprise Linux Desktop (v. 6) samba 3.6.23-14.el6_6, samba4 4.0.0-66.el6_6.rc4, libsmbclient 3.6.23-14.el6_6, samba-client 3.6.23-14.el6_6, samba-common 3.6.23-14.el6_6, samba4-dc 4.0.0-66.el6_6.rc4, +13 more Red Hat Enterprise Linux Desktop Optional (v. 6) samba 3.6.23-14.el6_6, samba-swat 3.6.23-14.el6_6, samba-glusterfs 3.6.23-14.el6_6, samba-domainjoin-gui 3.6.23-14.el6_6, samba-winbind-krb5-locator 3.6.23-14.el6_6fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0251
-
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) samba3x 3.6.23-9.el5_11fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0249
-
Red Hat Enterprise Linux EUS (v. 5.9 server) samba3x 3.6.6-0.131.el5_9, samba3x-swat 3.6.6-0.131.el5_9, samba3x-client 3.6.6-0.131.el5_9, samba3x-common 3.6.6-0.131.el5_9, samba3x-winbind 3.6.6-0.131.el5_9, samba3x-domainjoin-gui 3.6.6-0.131.el5_9fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0253
show 17 moreshow fewer
-
Red Hat Enterprise Linux HPC Node (v. 6) samba 3.6.23-14.el6_6, samba4 4.0.0-66.el6_6.rc4, samba-client 3.6.23-14.el6_6, samba-common 3.6.23-14.el6_6, samba4-dc 4.0.0-66.el6_6.rc4, samba-winbind 3.6.23-14.el6_6, +12 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0251
-
Red Hat Enterprise Linux HPC Node EUS (v. 6.4) samba 3.6.9-151.el6_4.3, samba4 4.0.0-57.el6_4.rc4, samba4-dc 4.0.0-57.el6_4.rc4, samba-client 3.6.9-151.el6_4.3, samba-common 3.6.9-151.el6_4.3, samba4-libs 4.0.0-57.el6_4.rc4, +12 more Red Hat Enterprise Linux HPC Node EUS (v. 6.5) samba 3.6.9-171.el6_5, samba4 4.0.0-65.el6_5.rc4, samba-client 3.6.9-171.el6_5, samba-common 3.6.9-171.el6_5, samba4-dc 4.0.0-65.el6_5.rc4, samba-winbind 3.6.9-171.el6_5, +12 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0254
-
Red Hat Enterprise Linux HPC Node Optional (v. 6) samba 3.6.23-14.el6_6, samba-swat 3.6.23-14.el6_6, libsmbclient 3.6.23-14.el6_6, samba-glusterfs 3.6.23-14.el6_6, samba-domainjoin-gui 3.6.23-14.el6_6, samba-winbind-krb5-locator 3.6.23-14.el6_6fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0251
-
Red Hat Enterprise Linux Long Life (v. 5.6 server) samba3x 3.5.4-0.70.el5_6.4, samba3x-swat 3.5.4-0.70.el5_6.4, samba3x-client 3.5.4-0.70.el5_6.4, samba3x-common 3.5.4-0.70.el5_6.4, samba3x-winbind 3.5.4-0.70.el5_6.4, samba3x-domainjoin-gui 3.5.4-0.70.el5_6.4fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0253
-
Red Hat Enterprise Linux Server (v. 6) samba 3.6.23-14.el6_6, samba4 4.0.0-66.el6_6.rc4, libsmbclient 3.6.23-14.el6_6, samba-client 3.6.23-14.el6_6, samba-common 3.6.23-14.el6_6, samba4-dc 4.0.0-66.el6_6.rc4, +13 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0251
-
Red Hat Enterprise Linux Server (v. 7) samba 4.1.1-38.el7_0, samba-libs 4.1.1-38.el7_0, libwbclient 4.1.1-38.el7_0, libsmbclient 4.1.1-38.el7_0, samba-client 4.1.1-38.el7_0, samba-common 4.1.1-38.el7_0, +3 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0252
-
Red Hat Enterprise Linux Server AUS (v. 6.2) samba 3.5.10-119.el6_2, libsmbclient 3.5.10-119.el6_2, samba-client 3.5.10-119.el6_2, samba-common 3.5.10-119.el6_2, samba-winbind 3.5.10-119.el6_2, samba-winbind-clients 3.5.10-119.el6_2 Red Hat Enterprise Linux Server EUS (v. 6.4) samba 3.6.9-151.el6_4.3, samba4 4.0.0-57.el6_4.rc4, samba4-dc 4.0.0-57.el6_4.rc4, libsmbclient 3.6.9-151.el6_4.3, samba-client 3.6.9-151.el6_4.3, samba-common 3.6.9-151.el6_4.3, +13 more Red Hat Enterprise Linux Server EUS (v. 6.5) samba 3.6.9-171.el6_5, samba4 4.0.0-65.el6_5.rc4, libsmbclient 3.6.9-171.el6_5, samba-client 3.6.9-171.el6_5, samba-common 3.6.9-171.el6_5, samba4-dc 4.0.0-65.el6_5.rc4, +13 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0254
-
Red Hat Enterprise Linux Server Optional (v. 6) samba-swat 3.6.23-14.el6_6, samba-glusterfs 3.6.23-14.el6_6, samba-domainjoin-gui 3.6.23-14.el6_6, samba-winbind-krb5-locator 3.6.23-14.el6_6fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0251
-
Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.1.1-38.el7_0, samba-pidl 4.1.1-38.el7_0, samba-test 4.1.1-38.el7_0, samba-python 4.1.1-38.el7_0, samba-dc-libs 4.1.1-38.el7_0, samba-vfs-glusterfs 4.1.1-38.el7_0, +2 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0252
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.2) samba 3.5.10-119.el6_2, samba-swat 3.5.10-119.el6_2, samba-domainjoin-gui 3.5.10-119.el6_2, samba-winbind-krb5-locator 3.5.10-119.el6_2 Red Hat Enterprise Linux Server Optional EUS (v. 6.4) samba 3.6.9-151.el6_4.3, samba-swat 3.6.9-151.el6_4.3, samba-domainjoin-gui 3.6.9-151.el6_4.3, samba-winbind-krb5-locator 3.6.9-151.el6_4.3 Red Hat Enterprise Linux Server Optional EUS (v. 6.5) samba 3.6.9-171.el6_5, samba-swat 3.6.9-171.el6_5, samba-domainjoin-gui 3.6.9-171.el6_5, samba-winbind-krb5-locator 3.6.9-171.el6_5fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0254
-
Red Hat Enterprise Linux Workstation (v. 6) samba 3.6.23-14.el6_6, samba4 4.0.0-66.el6_6.rc4, libsmbclient 3.6.23-14.el6_6, samba-client 3.6.23-14.el6_6, samba-common 3.6.23-14.el6_6, samba4-dc 4.0.0-66.el6_6.rc4, +13 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0251
-
Red Hat Enterprise Linux Workstation (v. 7) samba 4.1.1-38.el7_0, samba-libs 4.1.1-38.el7_0, libwbclient 4.1.1-38.el7_0, libsmbclient 4.1.1-38.el7_0, samba-client 4.1.1-38.el7_0, samba-common 4.1.1-38.el7_0, +3 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0252
-
Red Hat Enterprise Linux Workstation Optional (v. 6) samba-swat 3.6.23-14.el6_6, samba-glusterfs 3.6.23-14.el6_6, samba-domainjoin-gui 3.6.23-14.el6_6, samba-winbind-krb5-locator 3.6.23-14.el6_6fixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0251
-
Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.1.1-38.el7_0, samba-pidl 4.1.1-38.el7_0, samba-test 4.1.1-38.el7_0, samba-dc-libs 4.1.1-38.el7_0, samba-vfs-glusterfs 4.1.1-38.el7_0, samba-winbind-clients 4.1.1-38.el7_0, +1 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0252
-
Red Hat Storage Server 2.1 samba 3.6.9-167.10.3.el6rhs, samba-swat 3.6.9-167.10.3.el6rhs, libsmbclient 3.6.9-167.10.3.el6rhs, samba-client 3.6.9-167.10.3.el6rhs, samba-common 3.6.9-167.10.3.el6rhs, samba-winbind 3.6.9-167.10.3.el6rhs, +4 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0257
-
Red Hat Storage Server 3 samba 3.6.509-169.6.el6rhs, samba-swat 3.6.509-169.6.el6rhs, libsmbclient 3.6.509-169.6.el6rhs, samba-client 3.6.509-169.6.el6rhs, samba-common 3.6.509-169.6.el6rhs, samba-winbind 3.6.509-169.6.el6rhs, +4 morefixed: vendor fix “On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.” RHSA-2015:0256
-
Red Hat Enterprise Linux 4 samba Red Hat Enterprise Linux 5 sambanot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- First public exploit (EDB-36741)
Exploit prediction
88.19% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/scanner/smb/smb_uninit_cred Samba _netr_ServerPasswordSet Uninitialized Credential State metasploit auxiliary, normal rank
- EDB-36741 Samba < 3.6.2 (x86) - Denial of Service (PoC) dos, 2015-04-13
- securityblog.redhat.com https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-17 DEPRECATED: Code
References
-
exploit-db.com
/exploits/36741/
exploit
-
securityblog.redhat.com
/2015/02/23/samba-vulnerability-cve-2015-0240/
exploit
-
marc.info
/?l=bugtraq&m=143039217203031&w=2
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0257.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0254.html
vendor-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.360345
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0250.html
vendor-advisory
-
ubuntu.com
/usn/USN-2508-1
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00042.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-02/msg00035.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0253.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0249.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0251.html
vendor-advisory
-
security.gentoo.org
/glsa/glsa-201502-15.xml
vendor-advisory
-
debian.org
/security/2015/dsa-3171
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0252.html
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2015:082
vendor-advisory
-
marc.info
/?l=bugtraq&m=142722696102151&w=2
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00047.html
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2015:081
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0255.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00048.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-02/msg00031.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-0256.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-02/msg00030.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-02/msg00028.html
vendor-advisory
-
samba.org
/samba/security/CVE-2015-0240
vendor-advisory
- advisories.mageia.org /MGASA-2015-0084.html
- support.lenovo.com /product_security/samba_remote_vuln
-
securityfocus.com
/bid/72711
vdb-entry
-
securitytracker.com
/id/1031783
vdb-entry
- bugzilla.redhat.com /show_bug.cgi?id=1191325
- support.lenovo.com /us/en/product_security/samba_remote_vuln
- access.redhat.com /articles/1346913
- oracle.com /technetwork/topics/security/bulletinjan2015-2370101.html
- security.netapp.com /advisory/ntap-20250509-0001/
Sources
- CVE List CVE-2015-0240
- NVD CVE-2015-0240
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.