5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.185 Low
EPSS
Percentile
96.2%
There is a vulnerability in the smbd process which may allow an attacker to create a denial of service condition.
Samba
Samba is an open-source implementation of SMB/CIFS file and print services. It is frequently included in UNIX and Linux distributions and is typically used provide file and print services to Windows clients.
smbd
The smbd daemon is used to track connections to SMB network shares and printers.
The Problem
By sending a large number of share requests, an attacker can exhaust the system resources available to the smbd process.
An attacker may be able to cause a denial of service condition by exhausting the system resources used by the smbd daemon.
Upgrade
See the vendor of your operating system for patched smbd packages. Users who compile Samba from source should refer to the Samba webpage to obtain a patched version of the software.
Workarounds
Restrict Access
Blocking the SMB protocol at the network perimeter will reduce exposure to this vulnerability. Servers using the SMB protocol typically use ports 139/tcp
and 445/tcp
.
Disable Unnecessary Daemons
Do not enable the smbd daemon on systems that do not need to use the SMB protocol. Some operating systems have the smbd daemon started by default.
313836
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: July 11, 2006 Updated: July 17, 2006
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Thanks to the Samba team for reporting this vulnerability.
This document was written by Ryan Giobbi.
CVE IDs: | CVE-2006-3403 |
---|---|
Severity Metric: | 0.24 Date Public: |
frontal2.mandriva.com/security/advisories?name=MDKSA-2006:120
secunia.com/advisories/20980/
secunia.com/advisories/20983/
secunia.com/advisories/21018/
secunia.com/advisories/21019/
security.gentoo.org/glsa/glsa-200607-10.xml
us1.samba.org/samba/security/CAN-2006-3403.html
www.mandriva.com/security/advisories?name=MDKSA-2006:120
www.securityfocus.com/bid/18927
www.ubuntu.com/usn/usn-314-1
www.ubuntuforums.org/showthread.php?t=214283
issues.rpath.com/browse/RPL-496