PT-2015-3394 · Samba+5 · Samba+5

Adam Mariš · Published 2015-04-01 · Updated 2022-08-29 · CVE-2015-7540

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Samba versions prior to 4.1.22

Description The issue is related to the LDAP server in the AD domain controller in Samba, where it fails to check return values for successful ASN.1 memory allocation. This allows remote attackers to cause a denial of service, resulting in memory consumption and daemon crash, via crafted packets. The vulnerability is associated with an error in the resource management mechanism of the system.

Recommendations For versions prior to 4.1.22, update to version 4.1.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP server to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2015-1347

BDU:2021-01295

CESA-2016_0010

CVE-2015-7540

DSA-3433-1

OPENSUSE-SU-2015_2356-1

RHSA-2016:0010

RHSA-2016:0015

RHSA-2016_0010

USN-2855-1

USN-2855-2

Affected Products

Alt Linux

Centos

Red Hat

Samba

Suse

Ubuntu

References · 107

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330 · Security Note
• http://debian.org/security/2016/dsa-3433 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3433-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5299 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8467 · Vendor Advisory
• http://ubuntu.com/usn/USN-2855-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01299 · Security Note
• https://security.gentoo.org/glsa/201612-47 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110 · Security Note
• https://bdu.fstec.ru/vul/2021-01277 · Security Note
• https://ubuntu.com/security/CVE-2015-5252 · Vendor Advisory
• https://samba.org/samba/security/CVE-2015-7540.html · Vendor Advisory