Out-of-bounds

2023-07-2015:15:00

PRIOn knowledge base

www.prio-n.com

out-of-bounds read

samba

ntlm authentication

vulnerability

winbindd_pam_auth_crap.c

length checks

cryptographic challenges

winbind

malicious request

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.2%

JSON

An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.

CPENameOperatorVersion
debian_linuxeq12.0
fedoraeq37
fedoraeq38
enterprise_linuxeq7.0
enterprise_linuxeq6.0
enterprise_linuxeq8.0
enterprise_linuxeq9.0
sambage4.16.0
sambalt4.16.10
sambage4.17.0

Name	Operator	Version
debian_linux	eq	12.0
fedora	eq	37
fedora	eq	38
enterprise_linux	eq	7.0
enterprise_linux	eq	6.0
enterprise_linux	eq	8.0
enterprise_linux	eq	9.0
samba	ge	4.16.0
samba	lt	4.16.10
samba	ge	4.17.0