All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Aug 22, 2024 | Dec 10, 2019 |
| Debian | — | Upgrade samba | May 31, 2021 | Dec 10, 2019 |
| Freebsd | — | Upgrade samba410Upgrade samba411Upgrade samba48 | Dec 14, 2019 | Dec 12, 2019 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Mar 27, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade samba-clientUpgrade samba-winbindUpgrade libwbclientUpgrade sambaUpgrade samba-client-libsUpgrade samba-libsUpgrade samba-common-toolsUpgrade samba-pythonUpgrade libsmbclientUpgrade samba-commonUpgrade samba-common-libsUpgrade samba-winbind-clientsUpgrade samba-winbind-modules | Nov 3, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade samba-clientUpgrade samba-winbindUpgrade sambaUpgrade samba-client-libsUpgrade samba-libsUpgrade samba-winbind-clientsUpgrade samba-common-toolsUpgrade libwbclientUpgrade samba-winbind-modulesUpgrade libsmbclientUpgrade samba-pythonUpgrade samba-common-libsUpgrade samba-common | Sep 28, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade samba-commonUpgrade samba-winbind-modulesUpgrade samba-common-libsUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-common-toolsUpgrade libsmbclientUpgrade samba-pythonUpgrade samba-client-libsUpgrade samba-winbindUpgrade sambaUpgrade libwbclientUpgrade samba-libs | Feb 24, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-krb5-printingUpgrade samba-clientUpgrade samba-pidlUpgrade ctdbUpgrade samba-testUpgrade samba-commonUpgrade libwbclientUpgrade samba-test-libsUpgrade python3-sambaUpgrade python2-sambaUpgrade samba-libsUpgrade sambaUpgrade samba-winbind-modulesUpgrade python3-samba-testUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade ctdb-testsUpgrade samba-dc-libsUpgrade samba-common-libsUpgrade samba-winbindUpgrade samba-common-toolsUpgrade python2-samba-testUpgrade samba-winbind-krb5-locatorUpgrade samba-client-libs | Jan 3, 2020 | Dec 10, 2019 |
| Samba | — | Upgrade to Samba 4.10.11 or later.Upgrade to Samba 4.9.17 or later.Upgrade to Samba 4.11.3 or later. | Dec 16, 2019 | Dec 10, 2019 |
| Suse | — | Upgrade libsamba-util0Upgrade libsamba-hostconfig-develUpgrade samba-testUpgrade python-ldb-develUpgrade libndr-develUpgrade samba-cephUpgrade libsmbldap-develUpgrade libsmbclient0Upgrade ldb-toolsUpgrade libsamba-passdb0-32bitUpgrade libdcerpc-binding0-32bitUpgrade libsamba-passdb-develUpgrade libndr0Upgrade libsamba-errors0-32bitUpgrade libsamba-credentials0-32bitUpgrade samba-libs-python3-32bitUpgrade samba-ad-dcUpgrade libsamba-errors-develUpgrade libndr-nbt0-32bitUpgrade libnetapi-develUpgrade libndr-krb5pac0-32bitUpgrade libndr-standard0-32bitUpgrade libdcerpc-develUpgrade libsamba-policy0-python3-32bitUpgrade libldb1Upgrade samba-core-develUpgrade samba-dsdb-modulesUpgrade libndr-standard-develUpgrade libdcerpc-samr0Upgrade ctdb-testsUpgrade libsamba-credentials0Upgrade samba-pidlUpgrade libnetapi0Upgrade ctdbUpgrade libsmbconf-develUpgrade libsmbconf0-32bitUpgrade libndr1Upgrade samba-client-32bitUpgrade libsmbldap2-32bitUpgrade libsmbconf0Upgrade libndr1-32bitUpgrade libndr0-32bitUpgrade libwbclient0-32bitUpgrade libtevent-util0-32bitUpgrade libndr-krb5pac-develUpgrade libldb-develUpgrade libsamba-hostconfig0Upgrade libsamba-policy0-32bitUpgrade sambaUpgrade libndr-standard0Upgrade libsamba-passdb0Upgrade libtevent-util0Upgrade libsamba-policy0Upgrade libsamba-hostconfig0-32bitUpgrade libsamba-policy-develUpgrade libdcerpc-samr0-32bitUpgrade libdcerpc-binding0Upgrade libsmbclient0-32bitUpgrade libwbclient-develUpgrade libndr-krb5pac0Upgrade samba-winbind-32bitUpgrade libldb1-32bitUpgrade libdcerpc-samr-develUpgrade libsmbldap2Upgrade libsamdb-develUpgrade libsamdb0-32bitUpgrade libsamba-util-develUpgrade libndr-nbt0Upgrade libndr-nbt-develUpgrade samba-winbindUpgrade libsamba-credentials-develUpgrade libdcerpc0Upgrade libdcerpc0-32bitUpgrade libsamba-policy-python-develUpgrade libsamba-policy-python3-develUpgrade libsamdb0Upgrade samba-docUpgrade samba-ad-dc-32bitUpgrade samba-libs-32bitUpgrade python-ldbUpgrade samba-libs-pythonUpgrade libsmbclient-develUpgrade libsamba-policy0-python3Upgrade samba-pythonUpgrade samba-libsUpgrade samba-libs-python3Upgrade libnetapi0-32bitUpgrade libsamba-util0-32bitUpgrade samba-python3Upgrade libtevent-util-develUpgrade ctdb-pcp-pmdaUpgrade libsamba-errors0Upgrade samba-libs-python-32bitUpgrade samba-clientUpgrade libwbclient0 | Dec 24, 2019 | Dec 10, 2019 |
| Ubuntu | — | Upgrade libsmbclientUpgrade sambaUpgrade libsmbclient (Ubuntu Pro)Upgrade samba (Ubuntu Pro) | Dec 12, 2019 | Dec 10, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub