{"id":"CVE-2010-1635","aliases":["DEBIAN-CVE-2010-1635","EUVD-2010-1656","GHSA-xvfw-jjhx-vm37","openSUSE-SU-2024:10069-1"],"status":"published","title":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows...","description":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.038,"percentile":0.90079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2010-06-17T16:00:00Z","modified":"2026-10-23T17:47:49Z","fixes":[{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:3.6.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:3.6.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:3.6.1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.6.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.6.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.6.1-2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.1"}]}],"bundled":56}],"products":[{"vendor":"samba","product":"samba"}],"references":[{"url":"http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=25452a2268ac7013da28125f3df22085139af12d","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.stratsec.net/Research/Advisories/Samba-Multiple-DoS-Vulnerabilities-%28SS-2010-005%29","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://samba.org/samba/history/samba-3.4.8.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:141","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://samba.org/samba/history/samba-3.5.2.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=594921","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=7229","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.securityfocus.com/bid/40097","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","evidence"]},{"url":"http://security-tracker.debian.org/tracker/CVE-2010-1635","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2010/1933","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1635"},{"url":"http://git.samba.org/?p=samba.git;a=commit;h=25452a2268ac7013da28125f3df22085139af12d"},{"url":"http://www.stratsec.net/Research/Advisories/Samba-Multiple-DoS-Vulnerabilities-(SS-2010-005)"},{"url":"https://github.com/advisories/GHSA-xvfw-jjhx-vm37"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-1635","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2119","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2010-1635","description":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.","status":"published","published":"2010-06-17T16:00:00Z","modified":"2024-08-07T01:28:43.269Z","updated_at":"2026-11-02T14:33:28.858903Z"}],"euvd":[{"id":"EUVD-2010-1656","description":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.","status":"published","published":"2010-06-17T16:00:00Z","modified":"2024-08-07T01:28:43Z","updated_at":"2026-11-03T01:39:40.343238Z"}],"ghsa":[{"id":"GHSA-xvfw-jjhx-vm37","title":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows...","description":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.","status":"published","published":"2022-05-14T02:16:32Z","modified":"2023-02-21T05:06:04Z","updated_at":"2026-11-02T14:54:11.906282Z"}],"nvd":[{"id":"CVE-2010-1635","description":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.","status":"published","published":"2010-06-17T16:30:01.84Z","modified":"2026-06-16T23:18:45.353Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:47.724369Z"}],"osv":[{"id":"CVE-2010-1635","description":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.","status":"published","published":"2010-06-17T16:30:01Z","modified":"2026-04-10T03:41:13.747889Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2010-1635","description":"The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value.","status":"published","published":"2010-06-17T16:30:01.84Z","modified":"2026-10-23T17:47:49.416323217Z","updated_at":"2026-11-02T15:45:24.316685Z"},{"id":"openSUSE-SU-2024:10069-1","title":"ctdb-4.5.0-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:47:57.807269Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}