Resource management error in Samba - CVE-2021-3670

Vulnerability identifier: #VU66202

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3670

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to Samba AD DC LDAP does not honor the MaxQueryDuration option when handling LDAP requests. A remote user can execute heavy queries and perform a denial of service (DoS) attack.

Samba
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Availability
openSUSE Leap
openEuler
Ubuntu
libldb-help
python3-ldb-devel
libldb-devel
libldb-debuginfo
python-ldb-devel-common
python3-ldb
libldb-debugsource
libldb
ldb-tools
python3-ldb-32bit-debuginfo
python3-ldb-32bit
libldb2-32bit
ldb-debugsource
ldb-tools-debuginfo
libldb2
libldb2-debuginfo
python3-ldb-debuginfo
libldb2-32bit-debuginfo
samba-devel
samba-winbind-krb5-locator
libsmbclient-devel
samba-dc
samba-winbind-modules
python3-samba
samba-krb5-printing
python3-samba-dc
samba-debuginfo
python3-samba-test
samba-winbind
ctdb-tests
samba-libs
libwbclient-devel
samba-common-tools
samba-help
samba-dc-provision
samba-client
samba-dc-bind-dlz
samba-winbind-clients
samba-test
samba-common
ctdb
libwbclient
samba-pidl
samba-vfs-glusterfs
libsmbclient
samba-debugsource
samba
samba (Ubuntu package)
samba-winbind-libs-32bit
samba-libs-python3-32bit-debuginfo
samba-libs-python3-32bit
samba-libs-32bit-debuginfo
ctdb-pcp-pmda-debuginfo
samba-devel-32bit
samba-winbind-libs-32bit-debuginfo
ctdb-debuginfo
libsamba-policy-python3-devel
libsamba-policy-devel
ctdb-pcp-pmda
samba-python3
samba-libs-python3-debuginfo
samba-libs-python3
samba-libs-debuginfo
samba-ldb-ldap-debuginfo
samba-ldb-ldap
samba-gpupdate
samba-dsdb-modules-debuginfo
samba-dsdb-modules
samba-python3-debuginfo
samba-client-libs-debuginfo
samba-client-libs
samba-client-debuginfo
samba-ad-dc-libs-debuginfo
samba-ad-dc-libs
samba-ad-dc-debuginfo
samba-ad-dc
libsamba-policy0-python3-32bit
samba-client-libs-32bit-debuginfo
samba-client-libs-32bit
samba-client-32bit-debuginfo
samba-client-32bit
samba-ad-dc-libs-32bit-debuginfo
samba-ad-dc-libs-32bit
libsamba-policy0-python3
libsamba-policy0-python3-debuginfo
libsamba-policy0-python3-32bit-debuginfo
samba-libs-32bit
samba-doc
samba-ceph-debuginfo
samba-ceph
samba-winbind-libs-debuginfo
samba-winbind-libs
samba-winbind-debuginfo
samba-tool
samba-test-debuginfo
net-fs/samba

Vendor does not consider this a security vulnerability and recommends to follow general hardening rules to avoid similar attack vectors.

libldb-help - update to 2.0.12-5
python3-ldb-devel - update to 2.0.12-5
libldb-devel - update to 2.0.12-5
libldb-debuginfo - update to 2.0.12-5
python-ldb-devel-common - update to 2.0.12-5
python3-ldb - update to 2.0.12-5
libldb-debugsource - update to 2.0.12-5
libldb - update to 2.0.12-5
ldb-tools - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
python3-ldb-32bit-debuginfo - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
python3-ldb-32bit - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
libldb2-32bit - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
ldb-debugsource - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
ldb-tools-debuginfo - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
libldb-devel - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
libldb2 - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
libldb2-debuginfo - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
python3-ldb - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
python3-ldb-debuginfo - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
python3-ldb-devel - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
libldb2-32bit-debuginfo - addressed in versions 2.4.2-150300.3.15.1, 2.4.2-150400.4.3.11
samba-devel - update to 4.11.12-12
samba-winbind-krb5-locator - update to 4.11.12-12
libsmbclient-devel - update to 4.11.12-12
samba-dc - update to 4.11.12-12
samba-winbind-modules - update to 4.11.12-12
python3-samba - update to 4.11.12-12
samba-krb5-printing - update to 4.11.12-12
python3-samba-dc - update to 4.11.12-12
samba-debuginfo - update to 4.11.12-12
python3-samba-test - update to 4.11.12-12
samba-winbind - update to 4.11.12-12
ctdb-tests - update to 4.11.12-12
samba-libs - update to 4.11.12-12
libwbclient-devel - update to 4.11.12-12
samba-common-tools - update to 4.11.12-12
samba-help - update to 4.11.12-12
samba-dc-provision - update to 4.11.12-12
samba-client - update to 4.11.12-12
samba-dc-bind-dlz - update to 4.11.12-12
samba-winbind-clients - update to 4.11.12-12
samba-test - update to 4.11.12-12
samba-common - update to 4.11.12-12
ctdb - update to 4.11.12-12
libwbclient - update to 4.11.12-12
samba-pidl - update to 4.11.12-12
samba-vfs-glusterfs - update to 4.11.12-12
libsmbclient - update to 4.11.12-12
samba-debugsource - update to 4.11.12-12
samba - update to 4.11.12-12
samba (Ubuntu package) - addressed in versions 2:4.13.17~dfsg-0ubuntu1.20.04.1, 2:4.15.9+dfsg-0ubuntu0.2
samba-winbind-libs-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs-python3-32bit-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs-python3-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs-32bit-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
ctdb-pcp-pmda-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-devel-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-winbind-libs-32bit-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
ctdb - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
ctdb-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
libsamba-policy-python3-devel - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
libsamba-policy-devel - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
ctdb-pcp-pmda - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-debugsource - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-python3 - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs-python3-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs-python3 - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ldb-ldap-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ldb-ldap - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-gpupdate - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-dsdb-modules-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-dsdb-modules - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-devel - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-python3-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client-libs-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client-libs - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ad-dc-libs-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ad-dc-libs - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ad-dc-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ad-dc - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
libsamba-policy0-python3-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client-libs-32bit-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client-libs-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client-32bit-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-client-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ad-dc-libs-32bit-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ad-dc-libs-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
libsamba-policy0-python3 - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
libsamba-policy0-python3-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
libsamba-policy0-python3-32bit-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-libs-32bit - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-doc - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ceph-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-ceph - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-winbind-libs-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-winbind-libs - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-winbind-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-winbind - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-tool - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-test-debuginfo - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
samba-test - update to 4.15.7+git.376.dd43aca9ab2-150400.3.5.3
net-fs/samba - update to 4.18.4

• https://bugzilla.samba.org/show_bug.cgi?id=14694
• https://gitlab.com/samba-team/samba/-/commit/1d5b155619bc532c46932965b215bd73a920e56f

• SUSE update for ldb
• SUSE update for ldb, samba
• Ubuntu update for samba
• Gentoo update for Samba
• openEuler update for samba
• openEuler 20.03 LTS SP4 update for libldb