PT-2019-5407 · Samba+2 · Samba+2

Published 2019-06-19 · Updated 2024-06-15 · CVE-2019-12436

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Samba versions 4.10.x through 4.10.4

Description The issue is related to a NULL pointer dereference error, which can be exploited by a remote attacker to cause a Denial of Service (DoS) on the AD DC LDAP server. The attacker must have directory read access to attempt an exploit. This can be achieved by using the paged search control.

Recommendations For Samba versions 4.10.x through 4.10.4, update to version 4.10.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the directory read functionality to minimize the risk of exploitation.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-2360

ALT-PU-2019-2492

BDU:2020-02775

CVE-2019-12436

MGASA-2019-0286

OPENSUSE-SU-2024:11365-1

USN-4018-1

Affected Products

Alt Linux

Samba

Ubuntu

References · 98

• https://bdu.fstec.ru/vul/2020-00724 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-2492 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12436 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0286.html · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0286 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12436 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12435 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-12436 · Security Note
• https://usn.ubuntu.com/4018-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11365-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02775 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-2360 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-12436 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ3LCJNJ3ONHIRKDSKOTT6QGXALLCHVG · Vendor Advisory
• https://samba.org/samba/security/CVE-2019-12436.html · Vendor Advisory