Use of out-of-range pointer offset in Samba - CVE-2019-14861
Published: December 10, 2019
Vulnerability identifier: #VU23507
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14861
CWE-ID: CWE-823
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error when processing DNS records in ldb_qsort() and dns_name_compare() function within the dnsserver RPC pipe. A remote authenticated user can register a zone with an existing name but in different register and force Samba to read memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() calls. This will trigger Samba to follow invalid memory as a pointer and lead to DoS of the DNS management server.
Affected software
Samba
Gentoo Linux
Opensuse
Fedora
samba (Alpine package)
samba (Ubuntu package)
libsmbclient (Ubuntu package)
samba
RoboHelp
Gentoo Linux
Opensuse
Fedora
samba (Alpine package)
samba (Ubuntu package)
libsmbclient (Ubuntu package)
samba
RoboHelp
How to mitigate CVE-2019-14861
Install updates from vendor's website.
Samba - addressed in versions 4.9.17, 4.10.11, 4.11.3
samba (Alpine package) - update to 4.10.11-r0
samba (Ubuntu package) - addressed in versions 2:4.3.11+dfsg-0ubuntu0.16.04.24, 2:4.7.6+dfsg~ubuntu-0ubuntu2.14, 2:4.10.0+dfsg-0ubuntu2.7, 2:4.10.7+dfsg-0ubuntu2.3
libsmbclient (Ubuntu package) - update to 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4
samba - addressed in versions 4.10.11-0.fc30, 4.11.3-0.fc31
samba (Alpine package) - update to 4.10.11-r0
samba (Ubuntu package) - addressed in versions 2:4.3.11+dfsg-0ubuntu0.16.04.24, 2:4.7.6+dfsg~ubuntu-0ubuntu2.14, 2:4.10.0+dfsg-0ubuntu2.7, 2:4.10.7+dfsg-0ubuntu2.3
libsmbclient (Ubuntu package) - update to 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4
samba - addressed in versions 4.10.11-0.fc30, 4.11.3-0.fc31