All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Aug 22, 2024 | Dec 10, 2019 |
| Debian | — | Upgrade samba | May 31, 2021 | Dec 10, 2019 |
| Freebsd | — | Upgrade samba48Upgrade samba411Upgrade samba410 | Dec 14, 2019 | Dec 12, 2019 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Mar 27, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade samba-client-libsUpgrade samba-winbindUpgrade samba-libsUpgrade libwbclientUpgrade samba-common-toolsUpgrade sambaUpgrade samba-clientUpgrade samba-common-libsUpgrade samba-pythonUpgrade samba-winbind-modulesUpgrade libsmbclientUpgrade samba-commonUpgrade samba-winbind-clients | Nov 3, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade samba-pythonUpgrade samba-common-libsUpgrade samba-commonUpgrade libsmbclientUpgrade samba-common-toolsUpgrade samba-winbind-clientsUpgrade samba-libsUpgrade sambaUpgrade samba-client-libsUpgrade samba-winbindUpgrade samba-clientUpgrade samba-winbind-modulesUpgrade libwbclient | Sep 28, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsmbclientUpgrade samba-commonUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-common-libsUpgrade samba-winbind-modulesUpgrade samba-common-toolsUpgrade samba-pythonUpgrade samba-client-libsUpgrade samba-winbindUpgrade sambaUpgrade samba-libsUpgrade libwbclient | Feb 24, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-winbindUpgrade samba-client-libsUpgrade samba-dc-libsUpgrade libsmbclientUpgrade python3-samba-testUpgrade samba-winbind-krb5-locatorUpgrade python2-samba-testUpgrade samba-common-libsUpgrade ctdb-testsUpgrade samba-winbind-clientsUpgrade samba-common-toolsUpgrade samba-winbind-modulesUpgrade python3-sambaUpgrade samba-libsUpgrade samba-krb5-printingUpgrade samba-clientUpgrade samba-testUpgrade libwbclientUpgrade ctdbUpgrade python2-sambaUpgrade samba-test-libsUpgrade samba-commonUpgrade samba-pidlUpgrade samba | Jan 3, 2020 | Dec 10, 2019 |
| Samba | — | Upgrade to Samba 4.11.3 or later.Upgrade to Samba 4.9.17 or later.Upgrade to Samba 4.10.11 or later. | Dec 16, 2019 | Dec 10, 2019 |
| Suse | — | Upgrade libsmbconf0Upgrade libndr1Upgrade libtevent-util0-32bitUpgrade libnetapi-develUpgrade libndr1-32bitUpgrade samba-libs-python3-32bitUpgrade libndr0-32bitUpgrade libsamba-credentials0-32bitUpgrade libndr-develUpgrade libwbclient0-32bitUpgrade libsmbldap-develUpgrade libsmbconf-develUpgrade libnetapi0Upgrade samba-ad-dcUpgrade libldb1Upgrade samba-pidlUpgrade ldb-toolsUpgrade libsamba-passdb0-32bitUpgrade samba-cephUpgrade ctdbUpgrade libndr0Upgrade libdcerpc-samr0Upgrade libndr-standard-develUpgrade ctdb-testsUpgrade libdcerpc-binding0-32bitUpgrade libsamba-errors0-32bitUpgrade libsmbclient0Upgrade libsamba-errors-develUpgrade libsamba-util0Upgrade libndr-nbt0-32bitUpgrade samba-testUpgrade libsamba-hostconfig-develUpgrade libndr-standard0-32bitUpgrade libndr-krb5pac0-32bitUpgrade libsmbldap2-32bitUpgrade libsmbconf0-32bitUpgrade libdcerpc-develUpgrade samba-client-32bitUpgrade samba-core-develUpgrade samba-dsdb-modulesUpgrade libsamba-policy0-python3-32bitUpgrade libsamba-passdb-develUpgrade libsamba-credentials0Upgrade python-ldb-develUpgrade libsamba-policy-python-develUpgrade libsamba-credentials-develUpgrade libdcerpc0Upgrade libndr-krb5pac0Upgrade samba-docUpgrade libsamba-policy-python3-develUpgrade libndr-krb5pac-develUpgrade libndr-nbt0Upgrade libsamba-policy0-32bitUpgrade libsamba-policy0Upgrade libndr-standard0Upgrade libdcerpc0-32bitUpgrade libsamba-policy0-python3Upgrade libdcerpc-binding0Upgrade libsamdb0Upgrade samba-clientUpgrade libndr-nbt-develUpgrade libsamba-hostconfig0Upgrade libldb-develUpgrade sambaUpgrade libsamdb0-32bitUpgrade libsamba-passdb0Upgrade samba-libs-pythonUpgrade samba-winbindUpgrade samba-libsUpgrade samba-pythonUpgrade libsmbclient-develUpgrade ctdb-pcp-pmdaUpgrade libsamba-errors0Upgrade libnetapi0-32bitUpgrade samba-libs-python3Upgrade samba-python3Upgrade libsamba-util0-32bitUpgrade libtevent-util-develUpgrade libwbclient0Upgrade samba-ad-dc-32bitUpgrade samba-libs-32bitUpgrade python-ldbUpgrade libsamba-policy-develUpgrade libtevent-util0Upgrade libsamba-hostconfig0-32bitUpgrade libdcerpc-samr0-32bitUpgrade libsamba-util-develUpgrade samba-winbind-32bitUpgrade libdcerpc-samr-develUpgrade libwbclient-develUpgrade libsmbclient0-32bitUpgrade libsamdb-develUpgrade samba-libs-python-32bitUpgrade libsmbldap2Upgrade libldb1-32bit | Dec 24, 2019 | Dec 10, 2019 |
| Ubuntu | — | Upgrade sambaUpgrade samba (Ubuntu Pro)Upgrade libsmbclientUpgrade libsmbclient (Ubuntu Pro) | Dec 12, 2019 | Dec 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub