PT-2014-1428 · Samba+5 · Samba+5
Published
2014-06-23
·
Updated
2024-06-15
·
CVE-2014-0244
CVSS v2.0
8.3
High
| Vector | AV:A/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Samba versions 3.6.x through 3.6.23
Samba versions 4.0.x through 4.0.18
Samba versions 4.1.x through 4.1.8
Description
The issue affects the Samba software, allowing remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet. The
sys recvfrom function in nmbd is vulnerable. This can lead to disruption of confidentiality, integrity, and availability of protected information. An authenticated remote attacker can exploit this vulnerability.Recommendations
For Samba versions 3.6.x through 3.6.23, update to version 3.6.24 or later.
For Samba versions 4.0.x through 4.0.18, update to version 4.0.19 or later.
For Samba versions 4.1.x through 4.1.8, update to version 4.1.9 or later.
As a temporary workaround, consider restricting access to the
nmbd service until a patch is available.Fix
DoS
Code Injection
RCE
Buffer Overflow
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Samba
Suse
Ubuntu