PT-2016-3328 · Samba Team+6 · Samba+5

Jouni Knuutinen · Published 2015-04-01 · Updated 2024-06-15 · CVE-2015-5370

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Samba versions 3.x through 4.4.x before 4.4.2 Samba versions 4.3.x before 4.3.8 Samba versions 4.2.x before 4.2.11

Description The issue is related to a flaw in the implementation of the DCE-RPC layer, which can be exploited by remote attackers to perform protocol-downgrade attacks. This could lead to a denial of service, causing the application to crash or consume excessive CPU, or potentially allow the execution of arbitrary code on a client system. The vulnerability is associated with errors in the DCE-RPC implementation level.

Recommendations For Samba versions 3.x through 4.4.x before 4.4.2, update to version 4.4.2 or later. For Samba versions 4.3.x before 4.3.8, update to version 4.3.8 or later. For Samba versions 4.2.x before 4.2.11, update to version 4.2.11 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2015-1347

ALT-PU-2016-1324

ALT-PU-2016-1325

BDU:2021-01276

CESA-2016_0611

CESA-2016_0612

CVE-2015-5370

DSA-3548-1

DSA-3548-2

DSA-3548-3

ECHO-E300-A541-3DC2

MGASA-2016-0151

OPENSUSE-SU-2016_1025-1

OPENSUSE-SU-2016_1064-1

OPENSUSE-SU-2016_1106-1

OPENSUSE-SU-2024:10069-1

RHSA-2016:0611

RHSA-2016:0612

RHSA-2016:0613

RHSA-2016:0614

RHSA-2016:0618

RHSA-2016:0619

RHSA-2016:0620

RHSA-2016:0624

RHSA-2016_0611

RHSA-2016_0612

RHSA-2016_0613

SUSE-SU-2016:1022-1

SUSE-SU-2016:1023-1

SUSE-SU-2016:1024-1

SUSE-SU-2016:1028-1

SUSE-SU-2016_1022-1

SUSE-SU-2016_1023-1

SUSE-SU-2016_1024-1

SUSE-SU-2016_1028-1

USN-2950-1

USN-2950-2

USN-2950-3

USN-2950-5

Affected Products

Alt Linux

Centos

Red Hat

Samba

Suse

Ubuntu

References · 160

• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2950-5 · Vendor Advisory
• http://ubuntu.com/usn/USN-2950-4 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2950-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5370 · Security Note
• http://debian.org/security/2016/dsa-3548 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1028-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-0624.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2950-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5370 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0151.html · Security Note
• https://ubuntu.com/security/CVE-2015-5370 · Vendor Advisory