PT-2020-5783 · Samba+3 · Samba+3

Published 2020-01-21 · Updated 2025-01-14 · CVE-2019-19344

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: samba versions 4.9.x before 4.9.18 samba versions 4.10.x before 4.10.12 samba versions 4.11.x before 4.11.5

Description: The issue is related to a use-after-free problem, essentially due to a call to realloc() while other local variables still point at the original buffer. This can be exploited by a remote attacker to cause a denial of service.

Recommendations: For samba versions 4.9.x before 4.9.18, update to version 4.9.18 or later. For samba versions 4.10.x before 4.10.12, update to version 4.10.12 or later. For samba versions 4.11.x before 4.11.5, update to version 4.11.5 or later. As a temporary workaround, consider restricting access to the vulnerable samba functionality until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2020-1135

ALT-PU-2020-1901

BDU:2021-01742

CVE-2019-19344

DLA-3563-1

ECHO-3782-FA30-3960

MGASA-2020-0058

OPENSUSE-SU-2020:0122-1

OPENSUSE-SU-2020_0122-1

OPENSUSE-SU-2024:11365-1

SUSE-SU-2020:0223-1

SUSE-SU-2020:2673-1

USN-4244-1

Affected Products

Alt Linux

Samba

Suse

Ubuntu

References · 126

• https://ubuntu.com/security/CVE-2019-14907 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-19344 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19344 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19344 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19344 · Vendor Advisory
• https://samba.org/samba/security/CVE-2019-19344.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2673-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-52 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3563-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4244-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19344 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19344 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY · Vendor Advisory