Samba up to 4.9.16/4.10.10/4.11.2 AD Handleer ldb_qsort/dns_name_compare out-of-bounds

Summaryinfo

A vulnerability was found in Samba up to 4.9.16/4.10.10/4.11.2. It has been classified as critical. Impacted is the function ldb_qsort/dns_name_compare of the component AD Handleer. The manipulation leads to out-of-bounds. This vulnerability is documented as CVE-2019-14861. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Samba up to 4.9.16/4.10.10/4.11.2 (File Transfer Software) and classified as critical. This issue affects the function ldb_qsort/dns_name_compare of the component AD Handleer. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.

The weakness was released 12/10/2019 (Website). The advisory is shared at usn.ubuntu.com. The identification of this vulnerability is CVE-2019-14861 since 08/10/2019. The exploitation is known to be difficult. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. Technical details are known, but no exploit is available.

Upgrading to version 4.9.17, 4.10.11 or 4.11.3 eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-146923. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• File Transfer Software

Name

• Samba

Version

• 4.9.0
• 4.9.1
• 4.9.2
• 4.9.3
• 4.9.4
• 4.9.5
• 4.9.6
• 4.9.7
• 4.9.8
• 4.9.9
• 4.9.10
• 4.9.11
• 4.9.12
• 4.9.13
• 4.9.14
• 4.9.15
• 4.9.16
• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.10.4
• 4.10.5
• 4.10.6
• 4.10.7
• 4.10.8
• 4.10.9
• 4.10.10
• 4.11.0
• 4.11.1
• 4.11.2

License

• open-source

Website

• Product: https://www.samba.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion