var-202001-0521
Vulnerability from variot

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer. samba Contains a vulnerability involving the use of freed memory.Denial of service (DoS) May be in a state. ========================================================================== Ubuntu Security Notice USN-4244-1 January 21, 2020

samba vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.10
  • Ubuntu 19.04
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Samba.

Software Description: - samba: SMB/CIFS file, print, and login server for Unix

Details:

It was discovered that Samba did not automatically replicate ACLs set to inherit down a subtree on AD Directory, contrary to expectations. This issue was only addressed in Ubuntu 18.04 LTS, Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-14902)

Robert Święcki discovered that Samba incorrectly handled certain character conversions when the log level is set to 3 or above. (CVE-2019-14907)

Christian Naumer discovered that Samba incorrectly handled DNS zone scavenging. This issue could possibly result in some incorrect data being written to the DB. This issue only applied to Ubuntu 19.04 and Ubuntu 19.10. (CVE-2019-19344)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.10: samba 2:4.10.7+dfsg-0ubuntu2.4

Ubuntu 19.04: samba 2:4.10.0+dfsg-0ubuntu2.8

Ubuntu 18.04 LTS: samba 2:4.7.6+dfsg~ubuntu-0ubuntu2.15

Ubuntu 16.04 LTS: samba 2:4.3.11+dfsg-0ubuntu0.16.04.25

In general, a standard system update will make all the necessary changes.

References: https://usn.ubuntu.com/4244-1 CVE-2019-14902, CVE-2019-14907, CVE-2019-19344

Package Information: https://launchpad.net/ubuntu/+source/samba/2:4.10.7+dfsg-0ubuntu2.4 https://launchpad.net/ubuntu/+source/samba/2:4.10.0+dfsg-0ubuntu2.8 https://launchpad.net/ubuntu/+source/samba/2:4.7.6+dfsg~ubuntu-0ubuntu2.15 https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.16.04.25 . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202003-52

                                       https://security.gentoo.org/

Severity: Normal Title: Samba: Multiple vulnerabilities Date: March 25, 2020 Bugs: #664316, #672140, #686036, #693558, #702928, #706144 ID: 202003-52

Synopsis

Multiple vulnerabilities have been found in Samba, the worst of which could lead to remote code execution.

Background

Samba is a suite of SMB and CIFS client/server programs.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 net-fs/samba < 4.11.6 >= 4.9.18 >= 4.10.13 *>= 4.11.6

Description

Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code, cause a Denial of Service condition, conduct a man-in-the-middle attack, or obtain sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All Samba 4.9.x users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.9.18"

All Samba 4.10.x users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.10.13"

All Samba 4.11.x users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-fs/samba-4.11.6"

References

[ 1 ] CVE-2018-10858 https://nvd.nist.gov/vuln/detail/CVE-2018-10858 [ 2 ] CVE-2018-10918 https://nvd.nist.gov/vuln/detail/CVE-2018-10918 [ 3 ] CVE-2018-10919 https://nvd.nist.gov/vuln/detail/CVE-2018-10919 [ 4 ] CVE-2018-1139 https://nvd.nist.gov/vuln/detail/CVE-2018-1139 [ 5 ] CVE-2018-1140 https://nvd.nist.gov/vuln/detail/CVE-2018-1140 [ 6 ] CVE-2018-14629 https://nvd.nist.gov/vuln/detail/CVE-2018-14629 [ 7 ] CVE-2018-16841 https://nvd.nist.gov/vuln/detail/CVE-2018-16841 [ 8 ] CVE-2018-16851 https://nvd.nist.gov/vuln/detail/CVE-2018-16851 [ 9 ] CVE-2018-16852 https://nvd.nist.gov/vuln/detail/CVE-2018-16852 [ 10 ] CVE-2018-16853 https://nvd.nist.gov/vuln/detail/CVE-2018-16853 [ 11 ] CVE-2018-16857 https://nvd.nist.gov/vuln/detail/CVE-2018-16857 [ 12 ] CVE-2018-16860 https://nvd.nist.gov/vuln/detail/CVE-2018-16860 [ 13 ] CVE-2019-10197 https://nvd.nist.gov/vuln/detail/CVE-2019-10197 [ 14 ] CVE-2019-14861 https://nvd.nist.gov/vuln/detail/CVE-2019-14861 [ 15 ] CVE-2019-14870 https://nvd.nist.gov/vuln/detail/CVE-2019-14870 [ 16 ] CVE-2019-14902 https://nvd.nist.gov/vuln/detail/CVE-2019-14902 [ 17 ] CVE-2019-14907 https://nvd.nist.gov/vuln/detail/CVE-2019-14907 [ 18 ] CVE-2019-19344 https://nvd.nist.gov/vuln/detail/CVE-2019-19344

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/202003-52

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202001-0521",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "skynas",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "synology",
        "version": null
      },
      {
        "model": "directory server",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "synology",
        "version": null
      },
      {
        "model": "samba",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "samba",
        "version": "4.9.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "diskstation manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "synology",
        "version": "6.2"
      },
      {
        "model": "samba",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "samba",
        "version": "4.10.12"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.1"
      },
      {
        "model": "router manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "synology",
        "version": "1.2"
      },
      {
        "model": "samba",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "samba",
        "version": "4.9.18"
      },
      {
        "model": "samba",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "samba",
        "version": "4.10.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "19.10"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "19.04"
      },
      {
        "model": "samba",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "samba",
        "version": "4.11.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "samba",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "samba",
        "version": "4.11.5"
      },
      {
        "model": "samba",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "samba",
        "version": "4.11.x"
      },
      {
        "model": "diskstation manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "synology",
        "version": null
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "opensuse",
        "version": null
      },
      {
        "model": "samba",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "samba",
        "version": "project"
      },
      {
        "model": "samba",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "samba",
        "version": "4.11.5"
      },
      {
        "model": "router manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "synology",
        "version": null
      },
      {
        "model": "samba",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "samba",
        "version": "4.10.12"
      },
      {
        "model": "samba",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "samba",
        "version": "4.9.18"
      },
      {
        "model": "samba",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "samba",
        "version": "4.10.x"
      },
      {
        "model": "ubuntu",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "canonical",
        "version": null
      },
      {
        "model": "samba",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "samba",
        "version": "4.9.x"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.9.18",
                "versionStartIncluding": "4.9.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.10.12",
                "versionStartIncluding": "4.10.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.11.5",
                "versionStartIncluding": "4.11.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:synology:diskstation_manager:6.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:synology:directory_server:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:synology:router_manager:1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ubuntu,Gentoo",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2019-19344",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 4.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-19344",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "id": "VHN-151781",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 6.5,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-19344",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-19344",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "secalert@redhat.com",
            "id": "CVE-2019-19344",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202001-905",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-151781",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer. samba Contains a vulnerability involving the use of freed memory.Denial of service (DoS) May be in a state. ==========================================================================\nUbuntu Security Notice USN-4244-1\nJanuary 21, 2020\n\nsamba vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 19.10\n- Ubuntu 19.04\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Samba. \n\nSoftware Description:\n- samba: SMB/CIFS file, print, and login server for Unix\n\nDetails:\n\nIt was discovered that Samba did not automatically replicate ACLs set to\ninherit down a subtree on AD Directory, contrary to expectations. This\nissue was only addressed in Ubuntu 18.04 LTS, Ubuntu 19.04 and Ubuntu\n19.10. (CVE-2019-14902)\n\nRobert \u015awi\u0119cki discovered that Samba incorrectly handled certain character\nconversions when the log level is set to 3 or above. (CVE-2019-14907)\n\nChristian Naumer discovered that Samba incorrectly handled DNS zone\nscavenging. This issue could possibly result in some incorrect data being\nwritten to the DB. This issue only applied to Ubuntu 19.04 and Ubuntu\n19.10. (CVE-2019-19344)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 19.10:\n  samba                           2:4.10.7+dfsg-0ubuntu2.4\n\nUbuntu 19.04:\n  samba                           2:4.10.0+dfsg-0ubuntu2.8\n\nUbuntu 18.04 LTS:\n  samba                           2:4.7.6+dfsg~ubuntu-0ubuntu2.15\n\nUbuntu 16.04 LTS:\n  samba                           2:4.3.11+dfsg-0ubuntu0.16.04.25\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n  https://usn.ubuntu.com/4244-1\n  CVE-2019-14902, CVE-2019-14907, CVE-2019-19344\n\nPackage Information:\n  https://launchpad.net/ubuntu/+source/samba/2:4.10.7+dfsg-0ubuntu2.4\n  https://launchpad.net/ubuntu/+source/samba/2:4.10.0+dfsg-0ubuntu2.8\n  https://launchpad.net/ubuntu/+source/samba/2:4.7.6+dfsg~ubuntu-0ubuntu2.15\n  https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.16.04.25\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 202003-52\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: Samba: Multiple vulnerabilities\n     Date: March 25, 2020\n     Bugs: #664316, #672140, #686036, #693558, #702928, #706144\n       ID: 202003-52\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Samba, the worst of which\ncould lead to remote code execution. \n\nBackground\n==========\n\nSamba is a suite of SMB and CIFS client/server programs. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  net-fs/samba                 \u003c 4.11.6                 *\u003e= 4.9.18\n                                                          *\u003e= 4.10.13\n                                                           *\u003e= 4.11.6\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Samba. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nA remote attacker could possibly execute arbitrary code, cause a Denial\nof Service condition, conduct a man-in-the-middle attack, or obtain\nsensitive information. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Samba 4.9.x users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=net-fs/samba-4.9.18\"\n\nAll Samba 4.10.x users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=net-fs/samba-4.10.13\"\n\nAll Samba 4.11.x users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=net-fs/samba-4.11.6\"\n\nReferences\n==========\n\n[  1 ] CVE-2018-10858\n       https://nvd.nist.gov/vuln/detail/CVE-2018-10858\n[  2 ] CVE-2018-10918\n       https://nvd.nist.gov/vuln/detail/CVE-2018-10918\n[  3 ] CVE-2018-10919\n       https://nvd.nist.gov/vuln/detail/CVE-2018-10919\n[  4 ] CVE-2018-1139\n       https://nvd.nist.gov/vuln/detail/CVE-2018-1139\n[  5 ] CVE-2018-1140\n       https://nvd.nist.gov/vuln/detail/CVE-2018-1140\n[  6 ] CVE-2018-14629\n       https://nvd.nist.gov/vuln/detail/CVE-2018-14629\n[  7 ] CVE-2018-16841\n       https://nvd.nist.gov/vuln/detail/CVE-2018-16841\n[  8 ] CVE-2018-16851\n       https://nvd.nist.gov/vuln/detail/CVE-2018-16851\n[  9 ] CVE-2018-16852\n       https://nvd.nist.gov/vuln/detail/CVE-2018-16852\n[ 10 ] CVE-2018-16853\n       https://nvd.nist.gov/vuln/detail/CVE-2018-16853\n[ 11 ] CVE-2018-16857\n       https://nvd.nist.gov/vuln/detail/CVE-2018-16857\n[ 12 ] CVE-2018-16860\n       https://nvd.nist.gov/vuln/detail/CVE-2018-16860\n[ 13 ] CVE-2019-10197\n       https://nvd.nist.gov/vuln/detail/CVE-2019-10197\n[ 14 ] CVE-2019-14861\n       https://nvd.nist.gov/vuln/detail/CVE-2019-14861\n[ 15 ] CVE-2019-14870\n       https://nvd.nist.gov/vuln/detail/CVE-2019-14870\n[ 16 ] CVE-2019-14902\n       https://nvd.nist.gov/vuln/detail/CVE-2019-14902\n[ 17 ] CVE-2019-14907\n       https://nvd.nist.gov/vuln/detail/CVE-2019-14907\n[ 18 ] CVE-2019-19344\n       https://nvd.nist.gov/vuln/detail/CVE-2019-19344\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202003-52\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2020 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "db": "PACKETSTORM",
        "id": "156018"
      },
      {
        "db": "PACKETSTORM",
        "id": "156915"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-19344",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "156018",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "156915",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0249",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-151781",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "PACKETSTORM",
        "id": "156018"
      },
      {
        "db": "PACKETSTORM",
        "id": "156915"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ]
  },
  "id": "VAR-202001-0521",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-151781"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T11:43:19.691000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Synology-SA-20",
        "trust": 0.8,
        "url": "https://usn.ubuntu.com/4244-1/"
      },
      {
        "title": "samba Remediation of resource management error vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=109220"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-416",
        "trust": 1.1
      },
      {
        "problemtype": "Using freed memory (CWE-416) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/202003-52"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2019-19344"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20200122-0001/"
      },
      {
        "trust": 1.7,
        "url": "https://www.synology.com/security/advisory/synology_sa_20_01"
      },
      {
        "trust": 1.7,
        "url": "https://www.samba.org/samba/security/cve-2019-19344.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html"
      },
      {
        "trust": 1.7,
        "url": "https://usn.ubuntu.com/4244-1/"
      },
      {
        "trust": 1.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19344"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4aczvnmifqggxnjpmhavbn3h2u65fxqy/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/gq6u65i2k23yjc4fesw477wl55tu3ppt/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/gq6u65i2k23yjc4fesw477wl55tu3ppt/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4aczvnmifqggxnjpmhavbn3h2u65fxqy/"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200224-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200223-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/156018/ubuntu-security-notice-usn-4244-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/156915/gentoo-linux-security-advisory-202003-52.html"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2019-19344"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0249/"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/samba-three-vulnerabilities-31386"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14902"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14907"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/samba/2:4.10.0+dfsg-0ubuntu2.8"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/samba/2:4.10.7+dfsg-0ubuntu2.4"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/samba/2:4.7.6+dfsg~ubuntu-0ubuntu2.15"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.16.04.25"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4244-1"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16841"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16857"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10918"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16860"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10197"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14629"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16851"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10858"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16852"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10919"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14861"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16853"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1140"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14870"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1139"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "PACKETSTORM",
        "id": "156018"
      },
      {
        "db": "PACKETSTORM",
        "id": "156915"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "db": "PACKETSTORM",
        "id": "156018"
      },
      {
        "db": "PACKETSTORM",
        "id": "156915"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-01-21T00:00:00",
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "date": "2020-02-12T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "date": "2020-01-21T19:09:24",
        "db": "PACKETSTORM",
        "id": "156018"
      },
      {
        "date": "2020-03-26T14:45:19",
        "db": "PACKETSTORM",
        "id": "156915"
      },
      {
        "date": "2020-01-21T18:15:12.937000",
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "date": "2020-01-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-03-25T00:00:00",
        "db": "VULHUB",
        "id": "VHN-151781"
      },
      {
        "date": "2020-02-12T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      },
      {
        "date": "2023-11-07T03:07:38.380000",
        "db": "NVD",
        "id": "CVE-2019-19344"
      },
      {
        "date": "2020-03-27T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "156018"
      },
      {
        "db": "PACKETSTORM",
        "id": "156915"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ],
    "trust": 0.8
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "samba\u00a0 Vulnerabilities in use of freed memory",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014341"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "resource management error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-905"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.