Vulnerability record · CVE-2003-0201 · published 5 May 2003
CVE-2003-0201: Samba call_trans2open buffer overflow allows remote code execution
Samba · Samba
A buffer overflow exists in the call_trans2open function in trans2.c in Samba 2.2.x before 2.2.8a, Samba 2.0.10 and earlier 2.0.x, and Samba-TNG before 0.3.2. A remote attacker can trigger it over the network and execute arbitrary code. Because Samba is a core file and print sharing service, a compromised host can expose file data and provide a foothold for lateral movement.
Description
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote code execution with a CVSS 2.0 base score of 10 and very high EPSS, though the software is legacy and no KEV listing is present.
What it is
A buffer overflow exists in the call_trans2open function in trans2.c in Samba 2.2.x before 2.2.8a, Samba 2.0.10 and earlier 2.0.x, and Samba-TNG before 0.3.2. A remote attacker can trigger it over the network and execute arbitrary code. Because Samba is a core file and print sharing service, a compromised host can expose file data and provide a foothold for lateral movement.
Impact
An unauthenticated remote attacker can execute arbitrary code with the privileges of the Samba service, typically root, leading to full host compromise. This can result in data theft, service disruption, and use of the host as a pivot point.
Attack surface
The flaw is reachable over the network via SMB/CIFS requests handled by the Samba daemon; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing the affected Samba service is a candidate target.
Exploitation
The record is not listed in CISA KEV, but EPSS is very high (0.845 probability, 99.7th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit code exists. No ransomware group usage is documented.
What to do
- Upgrade Samba to 2.2.8a or later, or Samba-TNG to 0.3.2 or later, per vendor advisories.
- Apply the vendor patches referenced by Debian, Red Hat, Mandriva, Novell, SGI and others for affected distributions.
- Restrict network access to SMB/CIFS ports (TCP 139 and 445) to trusted hosts only.
- If patching is not immediately possible, disable or firewall the Samba service on affected systems.
- Monitor vendor advisories for updated fixes for the listed platforms (Apple, Compaq, HP, Sun).
Detection
- Inspect Samba logs for malformed or unusual trans2 open requests and repeated connection attempts.
- Use network IDS signatures for the call_trans2open overflow against SMB traffic on ports 139 and 445.
- Monitor for unexpected child processes or shell activity spawned by smbd.
- Audit exposed SMB services and confirm version levels against the affected ranges.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0201 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0201), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.
