CVE-2015-0240: canonical ubuntu_linux DEPRECATED: Code

CVSS: 10.0v2.0HighModified

AliasesMGASA-2015-0084SUSE-SU-2015:0353-1RHSA-2015:0249+13 more

Published 24-02-2015Last modified 09-05-2025

Vulnerability summary

CVE-2015-0240 is a high (CVSS 10.0) DEPRECATED: Code vulnerability in canonical ubuntu_linux. EPSS estimates a 87.59% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

87.59%

0%100%

Critical · -0.42 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10069-1

Timeline

24-02-2015
PublishedVulnerability first disclosed.
09-05-2025
Last modifiedVulnerability information updated.

Description

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

87.59%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.42 pp

From 88.01% on 19-09-2026

19-09-202619-10-2026

EPSS score

87.59%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (securityblog.redhat.com)
Maturity: unknown
exploit-databasedoslinux_x86Unverified
Samba < 3.6.2 (x86) - Denial of Service (PoC)
Maturity: poc
MetasploitremoteUnverified
Samba _netr_ServerPasswordSet Uninitialized Credential State
auxiliary/scanner/smb/smb_uninit_cred
Maturity: poc

Weaknesses

CWE · root cause

CWE-17DEPRECATED: CodeThis entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Affected systems

Redhat51 products

enterprise_linuxEOL5 | 6.0 | 7.0
libsmbclient< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
libsmbclient-devel< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
libwbclient< 0:4.1.1-38.el7_0
libwbclient-devel< 0:4.1.1-38.el7_0

samba< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-client< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-common< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-dc< 0:4.1.1-38.el7_0
samba-dc-libs< 0:4.1.1-38.el7_0
samba-debuginfo< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-devel< 0:4.1.1-38.el7_0
samba-doc< 0:3.6.23-14.el6_6 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-domainjoin-gui< 0:3.6.23-14.el6_6 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-glusterfs< 0:3.6.23-14.el6_6 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-libs< 0:4.1.1-38.el7_0
samba-pidl< 0:4.1.1-38.el7_0
samba-python< 0:4.1.1-38.el7_0
samba-swat< 0:3.6.23-14.el6_6 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-test< 0:4.1.1-38.el7_0
samba-test-devel< 0:4.1.1-38.el7_0
samba-vfs-glusterfs< 0:4.1.1-38.el7_0
samba-winbind< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-winbind-clients< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-winbind-devel< 0:3.6.23-14.el6_6 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-winbind-krb5-locator< 0:3.6.23-14.el6_6 | < 0:4.1.1-38.el7_0 | < 0:3.6.9-151.el6_4.3 | < 0:3.6.9-171.el6_5 | < 0:3.5.10-119.el6_2 | < 0:3.6.509-169.6.el6rhs | < 0:3.6.9-167.10.3.el6rhs
samba-winbind-modules< 0:4.1.1-38.el7_0
samba3x< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-client< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-common< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-debuginfo< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-doc< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-domainjoin-gui< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-swat< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-winbind< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba3x-winbind-devel< 0:3.6.23-9.el5_11 | < 0:3.5.4-0.70.el5_6.4 | < 0:3.6.6-0.131.el5_9
samba4< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-client< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-common< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-dc< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-dc-libs< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-debuginfo< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-devel< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-libs< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-pidl< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-python< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-swat< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-test< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-winbind< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-winbind-clients< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4
samba4-winbind-krb5-locator< 0:4.0.0-66.el6_6.rc4 | < 0:4.0.0-57.el6_4.rc4 | < 0:4.0.0-65.el6_5.rc4

Show all 51

Suse4 products

samba&distro=SUSE Linux Enterprise Desktop 12< 4.1.12-16.1
samba&distro=SUSE Linux Enterprise Server 12< 4.1.12-16.1
samba&distro=SUSE Linux Enterprise Server for SAP Applications 12< 4.1.12-16.1
samba&distro=SUSE Linux Enterprise Software Development Kit 12< 4.1.12-16.1

Novell3 products

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 14.10

Debian1 product

samba< 2:4.1.17+dfsg-1 | < 2:3.5.6~dfsg-3squeeze12 | < 2:3.6.6-6+deb7u5

Mageia1 product

samba< 3.6.25-1.mga4

Samba1 product

sambaEOL3.5.0 | 3.5.1 | 3.5.2 | 3.5.3 | 3.5.4 | 3.5.5 | 3.5.6 | 3.5.7 | 3.5.8 | 3.5.9 | 3.5.10 | 3.5.11 | 3.5.12 | 3.5.13 | 3.5.14 | 3.5.15 | 3.5.16 | 3.5.17 | 3.5.18 | 3.5.19 | 3.5.20 | 3.5.21 | 3.5.22 | 3.6.0 | 3.6.1 | 3.6.2 | 3.6.10 | 3.6.11 | 3.6.12 | 3.6.13 | 3.6.14 | 3.6.15 | 3.6.16 | 3.6.17 | 3.6.18 | 3.6.19 | 3.6.20 | 3.6.21 | 3.6.22 | 3.6.23 | 3.6.24 | 4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.0.5 | 4.0.6 | 4.0.7 | 4.0.8 | 4.0.9 | 4.0.10 | 4.0.11 | 4.0.12 | 4.0.13 | 4.0.14 | 4.0.15 | 4.0.16 | 4.0.17 | 4.0.18 | 4.0.19 | 4.0.20 | 4.0.21 | 4.0.22 | 4.0.23 | 4.0.24 | 4.1.0 | 4.1.1 | 4.1.2 | 4.1.3 | 4.1.4 | 4.1.5 | 4.1.6 | 4.1.7 | 4.1.8 | 4.1.9 | 4.1.10 | 4.1.11 | 4.1.12 | 4.1.13 | 4.1.14 | 4.1.15 | 4.1.16 | 4.2.0:rc1 | 4.2.0:rc2 | 4.2.0:rc3 | 4.2.0:rc4

Ubuntu1 product

samba< 2:4.1.6+dfsg-1ubuntu2.14.04.7

8 vendors · 63 products

References

75 links

marc.info?l=bugtraq&m=143039217203031&w=2Vendor AdvisoryX Refsource HP
rhn.redhat.com/errata/RHSA-2015-0257.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2015-0254.htmlVendor AdvisoryX Refsource REDHAT
securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/X Refsource CONFIRMExploitWEBARTICLE
advisories.mageia.org/MGASA-2015-0084.htmlX Refsource CONFIRM
www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.360345Vendor AdvisoryX Refsource SLACKWARE
www.exploit-db.com/exploits/36741/ExploitX Refsource EXPLOIT DB
rhn.redhat.com/errata/RHSA-2015-0250.htmlVendor AdvisoryX Refsource REDHAT
support.lenovo.com/product_security/samba_remote_vulnX Refsource CONFIRM
www.ubuntu.com/usn/USN-2508-1Vendor AdvisoryX Refsource UBUNTU

Show all 75 references

lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-02/msg00035.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2015-0253.htmlVendor AdvisoryX Refsource REDHAT
www.samba.org/samba/security/CVE-2015-0240X Refsource CONFIRMVendor AdvisoryARTICLEREPORT
www.securityfocus.com/bid/72711VDB EntryX Refsource BID
rhn.redhat.com/errata/RHSA-2015-0249.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2015-0251.htmlVendor AdvisoryX Refsource REDHAT
security.gentoo.org/glsa/glsa-201502-15.xmlVendor AdvisoryX Refsource GENTOO
www.debian.org/security/2015/dsa-3171Vendor AdvisoryX Refsource DEBIAN
www.securitytracker.com/id/1031783VDB EntryX Refsource SECTRACK
rhn.redhat.com/errata/RHSA-2015-0252.htmlVendor AdvisoryX Refsource REDHAT
bugzilla.redhat.com/show_bug.cgi?id=1191325X Refsource CONFIRMREPORT
www.mandriva.com/security/advisories?name=MDVSA-2015:082Vendor AdvisoryX Refsource MANDRIVA
marc.info?l=bugtraq&m=142722696102151&w=2Vendor AdvisoryX Refsource HP
lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlVendor AdvisoryX Refsource SUSE
support.lenovo.com/us/en/product_security/samba_remote_vulnX Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2015:081Vendor AdvisoryX Refsource MANDRIVA
rhn.redhat.com/errata/RHSA-2015-0255.htmlVendor AdvisoryX Refsource REDHAT
access.redhat.com/articles/1346913X Refsource CONFIRMARTICLE
www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlX Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-02/msg00031.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2015-0256.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2015-02/msg00030.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-02/msg00028.htmlVendor AdvisoryX Refsource SUSE
security.netapp.com/advisory/ntap-20250509-0001/
advisories.mageia.org/MGASA-2015-0084.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=15347REPORT
rhn.redhat.com/errata/RHSA-2015-0251.htmlWEB
www.suse.com/support/update/announcement/2015/suse-su-20150353-1/Advisory
bugzilla.suse.com/872912REPORT
bugzilla.suse.com/873922REPORT
bugzilla.suse.com/876312REPORT
bugzilla.suse.com/889175REPORT
bugzilla.suse.com/898031REPORT
bugzilla.suse.com/908627REPORT
bugzilla.suse.com/913238REPORT
bugzilla.suse.com/917376REPORT
www.suse.com/security/cve/CVE-2015-0240WEB
access.redhat.com/errata/RHSA-2015:0249Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0249.jsonAdvisory
access.redhat.com/security/cve/CVE-2015-0240REPORT
www.cve.org/CVERecord?id=CVE-2015-0240AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2015-0240Advisory
access.redhat.com/errata/RHSA-2015:0250Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0250.jsonAdvisory
access.redhat.com/errata/RHSA-2015:0251Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0251.jsonAdvisory
access.redhat.com/errata/RHSA-2015:0252Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0252.jsonAdvisory
access.redhat.com/errata/RHSA-2015:0253Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0253.jsonAdvisory
access.redhat.com/errata/RHSA-2015:0254Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0254.jsonAdvisory
access.redhat.com/errata/RHSA-2015:0255Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0255.jsonAdvisory
access.redhat.com/errata/RHSA-2015:0256Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0256.jsonAdvisory
access.redhat.com/errata/RHSA-2015:0257Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0257.jsonAdvisory
ubuntu.com/security/CVE-2015-0240REPORT
ubuntu.com/security/notices/USN-2508-1Advisory
security-tracker.debian.org/tracker/CVE-2015-0240Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities