NULL pointer dereference in Samba - CVE-2019-14847
Published: October 29, 2019
Vulnerability identifier: #VU22331
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14847
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within implementation of the MS-ADTS "3.1.1.3.1.3.3 Range Retrieval of Attribute Values" feature. A remote user with "get changes" extended access right can trigger NULL pointer dereference error and perform a denial of service (DoS) attack.
Affected software
Samba
Arch Linux
Opensuse
Fedora
samba (Alpine package)
samba (Ubuntu package)
samba
RoboHelp
Arch Linux
Opensuse
Fedora
samba (Alpine package)
samba (Ubuntu package)
samba
RoboHelp
How to mitigate CVE-2019-14847
Install updates from vendor's website.
Samba - addressed in versions 4.9.15, 4.10.10
samba (Alpine package) - update to 4.8.12-r1
samba (Ubuntu package) - addressed in versions 2:4.3.11+dfsg-0ubuntu0.16.04.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.13, 2:4.10.0+dfsg-0ubuntu2.6, 2:4.10.7+dfsg-0ubuntu2.2
samba - addressed in versions 4.9.15-0.fc29, 4.10.10-0.fc30
samba (Alpine package) - update to 4.8.12-r1
samba (Ubuntu package) - addressed in versions 2:4.3.11+dfsg-0ubuntu0.16.04.23, 2:4.7.6+dfsg~ubuntu-0ubuntu2.13, 2:4.10.0+dfsg-0ubuntu2.6, 2:4.10.7+dfsg-0ubuntu2.2
samba - addressed in versions 4.9.15-0.fc29, 4.10.10-0.fc30