CVE-2010-2063
HighPublic exploitBuffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted…
Published Jun 17, 2010 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2010-2063, DSA-2061-1
Key Facts
Patch immediately- CVE-2010-2063 is a high-severity vulnerability (CVSS 7.5 v2) affecting Samba, Ubuntu Linux (Canonical), Debian Linux and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 79% probability of exploitation in the next 30 days.
- Fixed versions are available, including ctdb 4.5.0-1.1, ctdb-pcp-pmda 4.5.0-1.1, ctdb-tests 4.5.0-1.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
79%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2010-2063 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted field in a packet.
Affected Products
115 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SambaSamba | See advisory | 3.3.12 |
| Ubuntu LinuxCanonical | 6.06, 8.04, 9.04 | n/a |
| Debian LinuxDebian | 5.0 | n/a |
| rootio-sambarootio | See advisory | 2:3.4.0~pre1-1 |
| libsmbclient-develoracle | See advisory | 3.0.33-3.29.el5_5 |
Patched Releases
ctdb
4.5.0-1.1
ctdb-pcp-pmda
4.5.0-1.1
ctdb-tests
4.5.0-1.1
libdcerpc-binding0
4.5.0-1.1
libdcerpc-binding0-32bit
4.5.0-1.1
libdcerpc-devel
4.5.0-1.1
libdcerpc-samr-devel
4.5.0-1.1
libdcerpc-samr0
4.5.0-1.1
libdcerpc-samr0-32bit
4.5.0-1.1
libdcerpc0
4.5.0-1.1
libdcerpc0-32bit
4.5.0-1.1
libndr-devel
4.5.0-1.1
libndr-krb5pac-devel
4.5.0-1.1
libndr-krb5pac0
4.5.0-1.1
libndr-krb5pac0-32bit
4.5.0-1.1
libndr-nbt-devel
4.5.0-1.1
libndr-nbt0
4.5.0-1.1
libndr-nbt0-32bit
4.5.0-1.1
libndr-standard-devel
4.5.0-1.1
libndr-standard0
4.5.0-1.1
libndr-standard0-32bit
4.5.0-1.1
libndr0
4.5.0-1.1
libndr0-32bit
4.5.0-1.1
libnetapi-devel
4.5.0-1.1
libnetapi0
4.5.0-1.1
Timeline
Publicly disclosed
Jun 17, 2010
Last updated
Aug 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-228 Improper Handling of Syntactically Invalid Structure
- CWE-1341 Multiple Releases of Same Resource or Handle
References
- advisoryAPPLE-SA-2010-08-24-1
- advisorySUSE-SR:2010:014
- advisoryHPSBUX02609
- advisoryHPSBUX02657
- advisoryRHSA-2010:0488
FAQ
Common Questions.
Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted field in a packet.
Affected: Samba; Ubuntu Linux (Canonical) versions 6.06, 8.04, 9.04; Debian Linux versions 5.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including ctdb 4.5.0-1.1, ctdb-pcp-pmda 4.5.0-1.1, ctdb-tests 4.5.0-1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2010-2063 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo