A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Nov 1, 2018 | Nov 1, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 1, 2018 |
| Debian | — | Upgrade samba | Dec 20, 2016 | Dec 19, 2016 |
| Freebsd | — | Upgrade samba42Upgrade samba4Upgrade samba45Upgrade samba36Upgrade samba41Upgrade samba44Upgrade samba43 | Dec 28, 2016 | Dec 26, 2016 |
| Oracle Solaris | — | Upgrade library/samba/libsmbclient to version 4.4.8-0.175.3.17.0.3.0 on Solaris 11.3Upgrade service/network/samba to version 4.4.8-0.175.3.17.0.3.0 on Solaris 11.3 | May 29, 2017 | May 29, 2017 |
| Samba | — | Upgrade to Samba version 4.5.3Upgrade to Samba version 4.4.8Upgrade to Samba version 4.3.13 | Dec 20, 2016 | Dec 20, 2016 |
| Suse | — | Upgrade libsamba-hostconfig0-debuginfoUpgrade samba-debuginfo-32bitUpgrade libdcerpc-samr0Upgrade libndr0-debuginfo-32bitUpgrade libndr-nbt0-debuginfoUpgrade libgensec0Upgrade libsmbclient-raw0Upgrade libnetapi-develUpgrade libdcerpc-binding0-32bitUpgrade libsmbldap-develUpgrade libdcerpc0Upgrade libndr-krb5pac-develUpgrade ctdb-tests-debuginfoUpgrade libndr-krb5pac0Upgrade samba-libs-python3-32bitUpgrade libsamdb0-debuginfoUpgrade samba-testUpgrade libregistry0Upgrade libtevent-util0-debuginfo-32bitUpgrade libnetapi0-debuginfo-32bitUpgrade libsamdb-develUpgrade libtevent-util0-debuginfoUpgrade samba-libs-debuginfo-32bitUpgrade libsmbclient0-debuginfo-32bitUpgrade libsmbconf0Upgrade libsmbclient0Upgrade libgensec0-32bitUpgrade libsamba-util0-debuginfo-32bitUpgrade libdcerpc-atsvc-develUpgrade libsamba-hostconfig0-debuginfo-32bitUpgrade libwbclient-develUpgrade libsamdb0-32bitUpgrade libsamba-hostconfig0-32bitUpgrade libtevent-util0-32bitUpgrade libsamba-policy0-32bitUpgrade libregistry0-debuginfo-32bitUpgrade libdcerpc0-debuginfoUpgrade libsamba-passdb0-debuginfo-32bitUpgrade libsamba-passdb0Upgrade libsmbclient0-debuginfoUpgrade samba-test-develUpgrade samba-core-develUpgrade libsmbldap2Upgrade libsmbconf0-32bitUpgrade libsmbldap0Upgrade libndr0-32bitUpgrade samba-pidlUpgrade libsamba-errors0Upgrade libdcerpc-binding0-debuginfoUpgrade libsamba-hostconfig-develUpgrade libdcerpc-atsvc0-debuginfoUpgrade libwbclient0-32bitUpgrade libndr0Upgrade samba-winbind-debuginfo-32bitUpgrade libsmbclient-raw0-32bitUpgrade libndr-standard0-debuginfo-32bitUpgrade libsmbconf0-debuginfo-32bitUpgrade libdcerpc-samr0-debuginfoUpgrade libsmbconf0-debuginfoUpgrade libregistry0-debuginfoUpgrade libsamdb0Upgrade libgensec0-debuginfoUpgrade ctdb-testsUpgrade ctdb-develUpgrade libsamba-policy0-debuginfoUpgrade libsmbconf-develUpgrade ctdb-debuginfoUpgrade libsamba-errors-develUpgrade libsamdb0-debuginfo-32bitUpgrade libdcerpc-atsvc0Upgrade libsamba-util0Upgrade libsmbldap0-debuginfo-32bitUpgrade libnetapi0-32bitUpgrade libsamba-passdb0-32bitUpgrade libsamba-credentials0-32bitUpgrade libdcerpc-samr0-debuginfo-32bitUpgrade samba-debugsourceUpgrade libndr-develUpgrade libndr-nbt0-32bitUpgrade samba-libs-32bitUpgrade samba-dsdb-modulesUpgrade libnetapi0Upgrade libndr-krb5pac0-32bitUpgrade libsmbclient-develUpgrade libndr-standard0Upgrade samba-client-debuginfo-32bitUpgrade libsmbldap0-32bitUpgrade libdcerpc-atsvc0-debuginfo-32bitUpgrade libsamba-credentials0-debuginfoUpgrade libsamba-credentials-develUpgrade libsmbclient0-32bitUpgrade libdcerpc-samr0-32bitUpgrade samba-winbind-debuginfoUpgrade samba-kdcUpgrade libdcerpc-binding0-debuginfo-32bitUpgrade libsmbldap0-debuginfoUpgrade libndr-standard0-32bitUpgrade libsamba-passdb-develUpgrade libndr-nbt0-debuginfo-32bitUpgrade libndr-krb5pac0-debuginfoUpgrade samba-client-32bitUpgrade libsamba-errors0-debuginfoUpgrade libsamba-policy0Upgrade samba-winbind-32bitUpgrade samba-libsUpgrade samba-client-debuginfoUpgrade libsamba-policy-develUpgrade libndr-nbt0Upgrade libsmbldap2-32bitUpgrade libgensec-develUpgrade samba-debuginfoUpgrade samba-clientUpgrade libsamba-policy0-debuginfo-32bitUpgrade samba-test-debuginfoUpgrade sambaUpgrade libsamba-credentials0-debuginfo-32bitUpgrade libsamba-util-develUpgrade libsamba-passdb0-debuginfoUpgrade libdcerpc-samr-develUpgrade libsamba-errors0-debuginfo-32bitUpgrade libsamba-util0-32bitUpgrade libsamba-hostconfig0Upgrade libsamba-errors0-32bitUpgrade samba-32bitUpgrade libnetapi0-debuginfoUpgrade libdcerpc-atsvc0-32bitUpgrade libdcerpc0-debuginfo-32bitUpgrade libsmbclient-raw0-debuginfo-32bitUpgrade libsmbclient-raw0-debuginfoUpgrade libsmbclient-raw-develUpgrade libdcerpc-develUpgrade libtevent-util-develUpgrade libgensec0-debuginfo-32bitUpgrade libdcerpc0-32bitUpgrade libregistry-develUpgrade libregistry0-32bitUpgrade libwbclient0-debuginfo-32bitUpgrade samba-libs-debuginfoUpgrade samba-pythonUpgrade libndr-standard0-debuginfoUpgrade libsamba-credentials0Upgrade ctdbUpgrade libdcerpc-binding0Upgrade samba-winbindUpgrade libsamba-util0-debuginfoUpgrade libndr-standard-develUpgrade libndr0-debuginfoUpgrade libtevent-util0Upgrade libwbclient0Upgrade libndr-krb5pac0-debuginfo-32bitUpgrade samba-docUpgrade libwbclient0-debuginfoUpgrade samba-python-debuginfoUpgrade libndr-nbt-develUpgrade samba-libs-python3 | Dec 28, 2016 | Dec 19, 2016 |
| Ubuntu | — | Upgrade libsmbclientUpgrade sambaUpgrade winbind | Dec 20, 2016 | Dec 19, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub