[UNKNOWN] samba
En bref
- Source
- NVD
- EPSS
- EPSS 6.23 % · centile 94 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2016-3226
- GCVE · GCVE-0-2016-2123
Avis du CERT-FR
- CERTFR-2016-AVI-423 — Multiples vulnérabilités dans Samba · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.0.26cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.1.0 ≤ 4.1.23cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.2.0 ≤ 4.2.14cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.13cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.8cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.3
Produits affectés
| Produit | Versions |
|---|---|
| [UNKNOWN] · samba | affected versions 4.0.0 to 4.5.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |