PT-2014-1431 · Samba+2 · Samba+2

Publicado 2014-05-28 · Atualizado 2024-06-15 · CVE-2014-0239

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Samba versions prior to 4.0.18

Description The internal DNS server in Samba does not check the QR field in the header section of an incoming DNS message before sending a response. This allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop.

Recommendations For versions prior to 4.0.18, update to version 4.0.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the internal DNS server to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2014-1728

BDU:2015-00391

CVE-2014-0239

ECHO-D287-EF1A-DDD2

OPENSUSE-SU-2024:10069-1

USN-2257-1

Produtos afetados

Alt Linux

Samba

Ubuntu

Referências · 75

• https://suse.com/security/cve/CVE-2015-5370 · Nota
• https://suse.com/security/cve/CVE-2009-2813 · Nota
• https://suse.com/security/cve/CVE-2009-2948 · Nota
• https://suse.com/security/cve/CVE-2013-4408 · Nota
• https://osv.dev/vulnerability/CVE-2014-0239 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2012-0870 · Nota
• https://security-tracker.debian.org/tracker/CVE-2014-0239 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3560 · Nota
• https://suse.com/security/cve/CVE-2013-0214 · Nota
• https://suse.com/security/cve/CVE-2011-0719 · Nota
• https://suse.com/security/cve/CVE-2016-2115 · Nota
• https://suse.com/security/cve/CVE-2015-5299 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0239 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-1863 · Nota