All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Aug 22, 2024 | Dec 10, 2019 |
| Debian | — | Upgrade samba | May 31, 2021 | Dec 10, 2019 |
| Freebsd | — | Upgrade samba48Upgrade samba411Upgrade samba410 | Dec 14, 2019 | Dec 12, 2019 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Mar 27, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade samba-common-toolsUpgrade sambaUpgrade samba-libsUpgrade samba-winbindUpgrade samba-clientUpgrade libwbclientUpgrade samba-client-libsUpgrade samba-commonUpgrade samba-common-libsUpgrade samba-pythonUpgrade samba-winbind-clientsUpgrade libsmbclientUpgrade samba-winbind-modules | Nov 3, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade samba-libsUpgrade samba-common-toolsUpgrade sambaUpgrade samba-winbind-modulesUpgrade samba-winbind-clientsUpgrade samba-client-libsUpgrade samba-clientUpgrade libwbclientUpgrade samba-winbindUpgrade libsmbclientUpgrade samba-pythonUpgrade samba-common-libsUpgrade samba-common | Sep 28, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsmbclientUpgrade samba-common-toolsUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-common-libsUpgrade samba-commonUpgrade samba-winbind-modulesUpgrade libwbclientUpgrade samba-libsUpgrade samba-pythonUpgrade samba-client-libsUpgrade samba-winbindUpgrade samba | Feb 24, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ctdb-testsUpgrade python2-samba-testUpgrade samba-client-libsUpgrade samba-winbindUpgrade samba-dc-libsUpgrade samba-common-toolsUpgrade samba-winbind-clientsUpgrade samba-winbind-krb5-locatorUpgrade samba-winbind-modulesUpgrade libsmbclientUpgrade python3-samba-testUpgrade samba-common-libsUpgrade python2-sambaUpgrade samba-pidlUpgrade samba-libsUpgrade sambaUpgrade python3-sambaUpgrade samba-test-libsUpgrade ctdbUpgrade samba-commonUpgrade libwbclientUpgrade samba-testUpgrade samba-clientUpgrade samba-krb5-printing | Jan 3, 2020 | Dec 10, 2019 |
| Samba | — | Upgrade to Samba 4.10.11 or later.Upgrade to Samba 4.9.17 or later.Upgrade to Samba 4.11.3 or later. | Dec 16, 2019 | Dec 10, 2019 |
| Suse | — | Upgrade samba-libs-python3-32bitUpgrade libnetapi-develUpgrade libtevent-util0-32bitUpgrade libwbclient0-32bitUpgrade libndr-standard0-32bitUpgrade libndr1-32bitUpgrade libldb1Upgrade libnetapi0Upgrade samba-ad-dcUpgrade libsamba-errors0-32bitUpgrade libdcerpc-binding0-32bitUpgrade libdcerpc-samr0Upgrade libsamba-passdb0-32bitUpgrade libsmbclient0Upgrade libsamba-passdb-develUpgrade libndr-standard-develUpgrade libndr0Upgrade ctdbUpgrade libsamba-credentials0Upgrade libsmbconf-develUpgrade ldb-toolsUpgrade ctdb-testsUpgrade libsmbconf0Upgrade samba-pidlUpgrade libsmbldap2-32bitUpgrade libsamba-policy0-python3-32bitUpgrade libdcerpc-develUpgrade samba-core-develUpgrade samba-dsdb-modulesUpgrade libndr1Upgrade libndr-nbt0-32bitUpgrade libsmbconf0-32bitUpgrade samba-client-32bitUpgrade libsamba-errors-develUpgrade libsamba-credentials0-32bitUpgrade libndr-develUpgrade libndr0-32bitUpgrade libsamba-util0Upgrade python-ldb-develUpgrade samba-testUpgrade libsamba-hostconfig-develUpgrade libndr-krb5pac0-32bitUpgrade samba-cephUpgrade libsmbldap-develUpgrade libtevent-util0Upgrade libndr-standard0Upgrade samba-winbindUpgrade libdcerpc0Upgrade samba-libs-pythonUpgrade libsamba-policy-python-develUpgrade libsamdb0Upgrade libsamba-policy0-python3Upgrade samba-libs-python-32bitUpgrade ctdb-pcp-pmdaUpgrade samba-pythonUpgrade samba-libsUpgrade libnetapi0-32bitUpgrade libsamba-policy-develUpgrade libtevent-util-develUpgrade libsamba-errors0Upgrade samba-libs-32bitUpgrade libldb1-32bitUpgrade libsmbclient0-32bitUpgrade libwbclient-develUpgrade samba-winbind-32bitUpgrade samba-libs-python3Upgrade libsamba-hostconfig0Upgrade samba-ad-dc-32bitUpgrade samba-clientUpgrade libsamba-policy0-32bitUpgrade sambaUpgrade libwbclient0Upgrade python-ldbUpgrade libndr-nbt0Upgrade libndr-krb5pac0Upgrade libsamdb0-32bitUpgrade samba-docUpgrade libsamdb-develUpgrade libsmbldap2Upgrade libsamba-util-develUpgrade libsamba-util0-32bitUpgrade libdcerpc-binding0Upgrade libsamba-policy0Upgrade samba-python3Upgrade libsamba-hostconfig0-32bitUpgrade libsmbclient-develUpgrade libdcerpc-samr0-32bitUpgrade libdcerpc-samr-develUpgrade libsamba-passdb0Upgrade libsamba-credentials-develUpgrade libndr-nbt-develUpgrade libsamba-policy-python3-develUpgrade libndr-krb5pac-develUpgrade libdcerpc0-32bitUpgrade libldb-devel | Dec 24, 2019 | Dec 10, 2019 |
| Ubuntu | — | Upgrade libsmbclientUpgrade sambaUpgrade libsmbclient (Ubuntu Pro)Upgrade samba (Ubuntu Pro) | Dec 12, 2019 | Dec 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub