samba
At a glance
- Source
- NVD
- EPSS
- EPSS 2.21 % · percentile 83 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.
Weaknesses (CWE)
- CWE-391 — DEPRECATED: Unchecked Error Condition
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-6523
- GCVE · GCVE-0-2020-14383
CERT-FR advisories
- CERTFR-2020-AVI-694 — Multiples vulnérabilités dans Samba · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.11.15cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.12.0 < 4.12.9cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.13.0 < 4.13.1cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| samba | affected samba 4.11.15, samba 4.12.9, samba 4.13.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |