Use-after-free in Samba - CVE-2020-10760

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU29485

Use-after-free in Samba - CVE-2020-10760

Published: July 2, 2020 / Updated: July 15, 2020


Vulnerability identifier: #VU29485
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]
CVE-ID: CVE-2020-10760
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error  in Samba AD DC Global Catalog with paged_results and VLV. A remote user can send a specially crafted request to the LDAP server, trigger a use-after-free error and perform a denial of service attack.



Affected software

Samba
Gentoo Linux
Ubuntu
Opensuse
openEuler
Fedora
samba (Alpine package)
libldb
samba (Ubuntu package)
samba-devel
samba
samba-help
samba-krb5-printing
samba-libs
samba-pidl
samba-test
samba-winbind
samba-winbind-clients
samba-winbind-krb5-locator
samba-winbind-modules
samba-debuginfo
ctdb
ctdb-tests
libsmbclient
libsmbclient-devel
libwbclient
libwbclient-devel
python3-samba
python3-samba-dc
python3-samba-test
samba-client
samba-common
samba-common-tools
samba-dc
samba-dc-bind-dlz
samba-dc-provision
samba-debugsource

How to mitigate CVE-2020-10760

Install updates from vendor's website.

Samba - addressed in versions 4.10.17, 4.11.11, 4.12.4
samba (Alpine package) - update to 4.12.5-r0
libldb - addressed in versions 2.0.12-1.fc31, 2.1.4-1.fc32
samba (Ubuntu package) - addressed in versions 2:3.6.25-0ubuntu0.12.04.20, 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm7, 2:4.3.11+dfsg-0ubuntu0.16.04.28, 2:4.7.6+dfsg~ubuntu-0ubuntu2.17, 2:4.10.7+dfsg-0ubuntu2.6, 2:4.11.6+dfsg-0ubuntu1.3
samba-devel - update to 4.11.6-8
samba - update to 4.11.6-8
samba-help - update to 4.11.6-8
samba-krb5-printing - update to 4.11.6-8
samba-libs - update to 4.11.6-8
samba-pidl - update to 4.11.6-8
samba-test - update to 4.11.6-8
samba-winbind - update to 4.11.6-8
samba-winbind-clients - update to 4.11.6-8
samba-winbind-krb5-locator - update to 4.11.6-8
samba-winbind-modules - update to 4.11.6-8
samba-debuginfo - update to 4.11.6-8
ctdb - update to 4.11.6-8
ctdb-tests - update to 4.11.6-8
libsmbclient - update to 4.11.6-8
libsmbclient-devel - update to 4.11.6-8
libwbclient - update to 4.11.6-8
libwbclient-devel - update to 4.11.6-8
python3-samba - update to 4.11.6-8
python3-samba-dc - update to 4.11.6-8
python3-samba-test - update to 4.11.6-8
samba-client - update to 4.11.6-8
samba-common - update to 4.11.6-8
samba-common-tools - update to 4.11.6-8
samba-dc - update to 4.11.6-8
samba-dc-bind-dlz - update to 4.11.6-8
samba-dc-provision - update to 4.11.6-8
samba-debugsource - update to 4.11.6-8
samba - addressed in versions 4.11.11-0.fc31, 4.12.5-0.fc32

External References

Related Security Bulletins