Rule--Sid13398--Summary:This event is generated when an attempt is made to exploit a known vulnerability in Samba.--Impact:Denial of Service. Information disclosure. Loss of integrity. Complete admin access.--Detailed Information:Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).--Affected Systems:Samba Samba 34--Attack Scenarios:--Ease of Attack:--False Positives:None known.--False Negatives:None known.--Corrective Action:Upgrade to the latest non-affected version of the software.Apply the appropriate vendor supplied patches.--Contributors:Sourcefire Vulnerability Research TeamThis document was generated from data supplied by the National Vulnerability Database. A product of the National Institute of Standards and Technology.For more information see http://nvd.nist.gov/--Additional References:--