CVE-2019-19344

CVE-2019-19344 affects Samba 4.9.x (before 4.9.18), 4.10.x (before 4.10.12), and 4.11.x (before 4.11.5). The issue is a use-after-free caused by a realloc() call while other local variables still reference the original buffer, impacting Samba AD DC DNS zone scavenging. Connected advisories confir...

PT-2020-5783 · Samba +3 · Samba +3

Name of the Vulnerable Software and Affected Versions: samba versions 4.9.x before 4.9.18 samba versions 4.10.x before 4.10.12 samba versions 4.11.x before 4.11.5 Description: The issue is related to a use-after-free problem, essentially due to a call to realloc while other local variables still...

CVE-2019-14902

There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers...

CVE-2019-14902

There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers...

UBUNTU-CVE-2019-19344

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc while other local variables still point at the original buffer...

Use after free during DNS zone scavenging

Description Samba 4.9 introduced an off-by-default feature to tombstone dynamically created DNS records that had reached their expiry time. This feature is controlled by the smb.conf option: dns zone scavenging = yes There is a use-after-free issue in this code, essentially due to a call to reall...

Crash after failed character conversion at

Description If samba is set with "log level = 3" or above then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process such ...

CVE-2019-14907

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" or above then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP...

CVE-2019-14907

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" or above then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP...

CVE-2018-10918

A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Diretory Domain Controller configuration...

samba:fuzz_nmblib_parse_packet: Heap-buffer-overflow in handle_name_ptrs

Project: https://gitlab.com/samba-team/samba.git Detailed Report: https://oss-fuzz.com/testcase?key=5638318155104256 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzznmblibparsepacket Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

samba:fuzz_nmblib_parse_packet: Heap-buffer-overflow in parse_nmb_name

Project: https://gitlab.com/samba-team/samba.git Detailed Report: https://oss-fuzz.com/testcase?key=5644827043823616 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzznmblibparsepacket Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

samba:fuzz_nmblib_parse_packet: Heap-buffer-overflow in parse_nmb_name

Project: https://gitlab.com/samba-team/samba.git Detailed Report: https://oss-fuzz.com/testcase?key=5108333216530432 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzznmblibparsepacket Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

samba:fuzz_ndr_drsuapi_TYPE_OUT: Heap-buffer-overflow in lzxpress_decompress

Project: https://gitlab.com/samba-team/samba.git Detailed Report: https://oss-fuzz.com/testcase?key=5724999789051904 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzzndrdrsuapiTYPEOUT Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

samba -- multiple vulnerabilities

The Samba Team reports: CVE-2019-14902 The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers. CVE-2019-14907 When processing untrusted string input Samba can read past the end of th...

EulerOS Virtualization for ARM 64 3.0.5.0 : samba (EulerOS-SA-2020-1040)

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords to restrict...

CVE-2019-3880

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Mitigation...

Security Bulletin: Action required for IBM Integration Bus Hypervisor Edition V9.0 for security vulnerabilities in Red Hat Linux

Summary IBM Integration Bus Hypervisor Edition V9.0 ship with Red Hat Enterprise Linux RHEL Server 6.2 which is vulnerable to CVE-2019-14833, CVE-2019-14847, CVE-2019-10218 Vulnerability Details CVEID: CVE-2019-14833 DESCRIPTION: A flaw was found in Samba, all versions starting samba 4.5.0 before...

openSUSE: Security Advisory for samba (openSUSE-SU-2019:2700-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE: Security Advisory for samba (openSUSE-SU-2019:2442-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...