A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Nov 1, 2018 | Nov 1, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 1, 2018 |
| Debian | — | Upgrade samba | Dec 20, 2016 | Dec 19, 2016 |
| Freebsd | — | Upgrade samba42Upgrade samba4Upgrade samba36Upgrade samba41Upgrade samba43 | Dec 28, 2016 | Dec 26, 2016 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.4.8-0.175.3.17.0.3.0 on Solaris 11.3Upgrade library/samba/libsmbclient to version 4.4.8-0.175.3.17.0.3.0 on Solaris 11.3 | May 29, 2017 | May 29, 2017 |
| Samba | — | Upgrade to Samba version 4.4.8Upgrade to Samba version 4.3.13Upgrade to Samba version 4.5.3 | Dec 20, 2016 | Dec 20, 2016 |
| Suse | — | Upgrade libsamba-util0-32bitUpgrade libsmbclient-raw-develUpgrade libwbclient0-debuginfo-32bitUpgrade libdcerpc-atsvc0-32bitUpgrade samba-test-debuginfoUpgrade samba-kdcUpgrade libndr-standard0-32bitUpgrade libsmbldap0-debuginfoUpgrade samba-libs-debuginfoUpgrade libdcerpc-samr0-32bitUpgrade libsamba-passdb-develUpgrade samba-winbind-debuginfoUpgrade libsamba-errors0-debuginfo-32bitUpgrade libsamba-credentials0-debuginfoUpgrade libdcerpc0-32bitUpgrade libsmbclient0-32bitUpgrade libregistry-develUpgrade libtevent-util-develUpgrade samba-pythonUpgrade samba-winbind-32bitUpgrade libsmbclient-raw0-debuginfo-32bitUpgrade libsamba-credentials0Upgrade libgensec0-debuginfo-32bitUpgrade libndr-standard0-debuginfoUpgrade libndr-krb5pac0-32bitUpgrade samba-libsUpgrade sambaUpgrade samba-python-debuginfoUpgrade libsamba-errors0-debuginfoUpgrade samba-client-debuginfoUpgrade libndr0-debuginfoUpgrade samba-clientUpgrade ctdbUpgrade samba-winbindUpgrade libsamba-errors0-32bitUpgrade libsmbclient-raw0-debuginfoUpgrade libsamba-credentials0-debuginfo-32bitUpgrade libndr-nbt-develUpgrade samba-client-32bitUpgrade samba-libs-python3Upgrade samba-client-debuginfo-32bitUpgrade libsmbldap0-32bitUpgrade libnetapi0-debuginfoUpgrade libsamba-hostconfig0Upgrade samba-libs-32bitUpgrade libsamba-passdb0-debuginfoUpgrade libndr-krb5pac0-debuginfo-32bitUpgrade libdcerpc-binding0Upgrade libdcerpc-develUpgrade libndr-standard-develUpgrade libwbclient0Upgrade libsamba-util0-debuginfoUpgrade samba-docUpgrade libtevent-util0Upgrade libtevent-util0-debuginfo-32bitUpgrade libsamdb0-32bitUpgrade libwbclient-develUpgrade libndr-nbt0-debuginfoUpgrade libsamba-passdb0-debuginfo-32bitUpgrade libregistry0Upgrade samba-testUpgrade libsamba-passdb0-32bitUpgrade libdcerpc-samr0-debuginfo-32bitUpgrade ctdb-debuginfoUpgrade libnetapi0-32bitUpgrade libsamba-errors-develUpgrade libsamba-credentials0-32bitUpgrade libsamba-util0Upgrade libsmbldap0-debuginfo-32bitUpgrade libsmbconf0-debuginfoUpgrade samba-debugsourceUpgrade libsmbclient-raw0-32bitUpgrade libsmbclient0-debuginfoUpgrade samba-libs-debuginfo-32bitUpgrade libndr-standard0-debuginfo-32bitUpgrade libwbclient0-32bitUpgrade libregistry0-debuginfoUpgrade libsmbconf0-debuginfo-32bitUpgrade libndr-krb5pac-develUpgrade libndr-nbt0-debuginfo-32bitUpgrade libndr-nbt0Upgrade libsamba-policy-develUpgrade libdcerpc-samr-develUpgrade libsamba-policy0-debuginfo-32bitUpgrade samba-dsdb-modulesUpgrade libregistry0-32bitUpgrade libndr-krb5pac0-debuginfoUpgrade libnetapi0Upgrade libgensec-develUpgrade libsamba-util-develUpgrade libsmbldap2-32bitUpgrade samba-debuginfoUpgrade samba-32bitUpgrade libdcerpc-binding0-debuginfo-32bitUpgrade libdcerpc0-debuginfo-32bitUpgrade libndr-standard0Upgrade libdcerpc-atsvc0-debuginfo-32bitUpgrade libsamba-credentials-develUpgrade libsmbclient-develUpgrade libwbclient0-debuginfoUpgrade libsamba-policy0 | Dec 28, 2016 | Dec 19, 2016 |
| Ubuntu | — | Upgrade libsmbclientUpgrade winbindUpgrade samba | Dec 20, 2016 | Dec 19, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub