CVE-2015-5370

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 19.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-25 · updated 2026-06-17

Description

Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.

Affected products

Canonical Ubuntu Linux: 14.04, 15.10, 16.04
Samba: 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5 (+92)

References

http://badlock.org/
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

Get alerted when CVE-2015-5370 or the next vulnerability affects your stack