cbcvebase.
CVE-2019-14907
published 2020-01-21

CVE-2019-14907: All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then…

medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

Affected

25 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiansamba< samba 2:4.11.5+dfsg-1 (bookworm)samba 2:4.11.5+dfsg-1 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
red_hatsamba
red_hatsamba
red_hatsamba
redhatenterprise_linux
redhatenterprise_linux
redhatstorage
sambasamba>= 0 < 2:4.11.5+dfsg-12:4.11.5+dfsg-1
sambasamba>= 0 < 2:4.11.5+dfsg-12:4.11.5+dfsg-1
sambasamba>= 0 < 2:4.11.5+dfsg-12:4.11.5+dfsg-1
sambasamba>= 0 < 2:4.11.5+dfsg-12:4.11.5+dfsg-1
sambasamba>= 0 < 2:4.3.11+dfsg-0ubuntu0.16.04.252:4.3.11+dfsg-0ubuntu0.16.04.25
sambasamba>= 0 < 2:4.7.6+dfsg~ubuntu-0ubuntu2.152:4.7.6+dfsg~ubuntu-0ubuntu2.15
sambasamba>= 4.10.0 < 4.10.124.10.12
sambasamba>= 4.11.0 < 4.11.54.11.5
sambasamba>= 4.9.0 < 4.9.184.9.18
synologydiskstation_manager
synologyrouter_manager

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM