CVE-2008-1105: Samba receive_smb_raw heap buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe vulnerability is remotely exploitable without authentication and has a high EPSS score, though it is not listed in CISA KEV and no public exploit tags are present in the record.

What it is

Samba 3.0.0 through 3.0.29 contains a heap-based buffer overflow in the receive_smb_raw function in util/sock.c. A remote attacker can trigger the overflow by sending a crafted SMB response, which can corrupt heap memory and potentially lead to arbitrary code execution. The flaw affects Samba and downstream Linux distributions including Ubuntu and Debian.

Impact

A successful exploit can allow a remote attacker to execute arbitrary code with the privileges of the vulnerable Samba process, potentially leading to full compromise of the affected service. The CVSS 2.0 vector indicates partial confidentiality, integrity, and availability impact.

Attack surface

The vulnerability is reachable over the network via SMB traffic, as indicated by the AV:N vector. No authentication or user interaction is required according to the CVSS vector (Au:N).

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation activity (0.69085, 99.3rd percentile). Reference tags are limited to third-party advisories and mailing lists, with no public exploit tags present in the supplied data.

What to do

• Upgrade Samba to a version later than 3.0.29 or apply the vendor-supplied patch for CVE-2008-1105.
• Restrict network access to SMB services (TCP 139/445) to trusted hosts only.
• Monitor vendor advisories from Samba, Ubuntu, and Debian for updated packages and apply them promptly.
• If Samba cannot be patched immediately, consider disabling or isolating the SMB service until remediation is possible.

Detection

• Monitor SMB traffic for malformed or unusually large responses that could trigger the receive_smb_raw overflow.
• Check Samba logs for crashes or abnormal termination of the smbd process.
• Use network intrusion detection signatures targeting SMB response parsing anomalies if available.
• Audit systems for Samba versions between 3.0.0 and 3.0.29 and verify patch status.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.