[UNKNOWN] samba
At a glance
- Source
- NVD
- EPSS
- EPSS 6.23 % · percentile 94 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
Weaknesses (CWE)
- CWE-122 — Heap-based Buffer Overflow
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2016-3226
- GCVE · GCVE-0-2016-2123
CERT-FR advisories
- CERTFR-2016-AVI-423 — Multiples vulnérabilités dans Samba · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.0.26cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.1.0 ≤ 4.1.23cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.2.0 ≤ 4.2.14cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.13cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.8cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.3
Affected products
| Product | Versions |
|---|---|
| [UNKNOWN] · samba | affected versions 4.0.0 to 4.5.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |