Integer underflow in Samba - CVE-2016-2123
Published: May 23, 2017
Vulnerability identifier: #VU6632
CSH Severity: Medium
CVSS v4: 9.4 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2016-2123
CWE-ID: CWE-191
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to compromise vulnerable server.
The vulnerability exists due to integer underflow within ndr_pull_dnsp_name routine when processing dnsRecord attribute in LDAP requests. A remote authenticated attacker can send a specially crafted LDAP request to the affected server, trigger heap-based buffer overflow and execute arbitrary code on the target sever.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable server.
The vulnerability exists due to integer underflow within ndr_pull_dnsp_name routine when processing dnsRecord attribute in LDAP requests. A remote authenticated attacker can send a specially crafted LDAP request to the affected server, trigger heap-based buffer overflow and execute arbitrary code on the target sever.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable server.
Affected software
Samba
Arch Linux
Ubuntu
Slackware Linux
samba (Alpine package)
Arch Linux
Ubuntu
Slackware Linux
samba (Alpine package)
How to mitigate CVE-2016-2123
The vulnerability is patched in versions: 4.5.3, 4.4.8 and 4.3.13.
samba (Alpine package) - update to 4.2.14-r1