CVE-2009-2906: canonical ubuntu_linux Loop with Unreachable Exit Condition

Modified

AliasesRHSA-2009:1528DEBIAN-CVE-2009-2906

Published 07-10-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-2906 is a medium (CVSS 4.0) Loop with Unreachable Exit Condition vulnerability in canonical ubuntu_linux. EPSS estimates a 4.21% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.0/10

010

Medium · v2.0 (NVD)

EPSS score

4.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 2

DSA-1908-1 OPENSUSE-SU-2024:10069-1 OPENSUSE-SU-2024:10334-1 RHSA-2009:1529 RHSA-2009:1585

Timeline

07-10-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.

CVSS metrics

1 score · 1 source · 1 version

v2.04.0

EPSS trend

Probability

4.21%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected systems

Version check

Known conditions: network-reachable, authentication (CVSS vector). Other conditions: not stated in public data.

Redhat5 products

samba< 0:3.0.9-1.3E.16
samba-client< 0:3.0.9-1.3E.16
samba-common< 0:3.0.9-1.3E.16
samba-debuginfo< 0:3.0.9-1.3E.16
samba-swat< 0:3.0.9-1.3E.16

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04

Debian1 product

samba< 2:3.4.2-1

Samba1 product

sambaEOL< 3.0.37 | ≥ 3.2.0, < 3.2.15 | ≥ 3.3.0, < 3.3.8 | 3.4.0 | 3.4.1

4 vendors · 8 products

References

36 links

samba.org/samba/security/CVE-2009-2906.htmlX Refsource CONFIRMVendor Advisory
news.samba.org/releases/3.4.2/X Refsource CONFIRMVendor Advisory
www.securityfocus.com/archive/1/507856/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9944VDB EntrySignatureX Refsource OVALThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.htmlVendor AdvisoryX Refsource FEDORAPatchThird Party Advisory
lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
news.samba.org/releases/3.2.15/X Refsource CONFIRMVendor Advisory
sunsolve.sun.com/search/document.do?assetkey=1-77-1021111.1-1Vendor AdvisoryX Refsource SUNALERTBroken Link
osvdb.org/58519VDB EntryX Refsource OSVDBBroken Link
www.vupen.com/english/advisories/2009/2810VDB EntryX Refsource VUPENPatchThird Party Advisory

Show all 36 references

slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439Vendor AdvisoryX Refsource SLACKWAREPatchThird Party Advisory
secunia.com/advisories/37428Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/36937Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.ubuntu.com/usn/USN-839-1Vendor AdvisoryX Refsource UBUNTUPatchThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/53575VDB EntryX Refsource XFThird Party Advisory
support.apple.com/kb/HT4077X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/36573VDB EntryX Refsource BIDPatchThird Party Advisory
news.samba.org/releases/3.0.37/X Refsource CONFIRMVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7090VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/36918Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1022976VDB EntryX Refsource SECTRACKThird Party Advisory
secunia.com/advisories/36893Third Party AdvisoryX Refsource SECUNIAVendor Advisory
news.samba.org/releases/3.3.8/X Refsource CONFIRMVendor Advisory
secunia.com/advisories/36953Third Party AdvisoryX Refsource SECUNIAVendor Advisory
wiki.rpath.com/Advisories:rPSA-2009-0145X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.htmlVendor AdvisoryX Refsource FEDORAPatchThird Party Advisory
access.redhat.com/errata/RHSA-2009:1528Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=242754REPORT
bugzilla.redhat.com/show_bug.cgi?id=526645REPORT
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1528.jsonAdvisory
access.redhat.com/security/cve/CVE-2009-2906REPORT
www.cve.org/CVERecord?id=CVE-2009-2906Advisory
nvd.nist.gov/vuln/detail/CVE-2009-2906Advisory
security-tracker.debian.org/tracker/CVE-2009-2906Advisory