CVE-2020-10700
published 2020-05-04CVE-2020-10700: A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a…
PriorityP426medium5.3CVSS 3.1
AVNACHPRNUIRSUCNINAH
EPSS
1.97%
78.3th percentile
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.12.3+dfsg-2 (bookworm) | samba 2:4.12.3+dfsg-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| red_hat | samba | — | — |
| red_hat | samba | — | — |
| red_hat | samba | — | — |
| samba | samba | >= 0 < 2:4.12.3+dfsg-2 | 2:4.12.3+dfsg-2 |
| samba | samba | >= 0 < 2:4.12.3+dfsg-2 | 2:4.12.3+dfsg-2 |
| samba | samba | >= 0 < 2:4.12.3+dfsg-2 | 2:4.12.3+dfsg-2 |
| samba | samba | >= 0 < 2:4.12.3+dfsg-2 | 2:4.12.3+dfsg-2 |
| samba | samba | >= 0 < 2:4.3.11+dfsg-0ubuntu0.16.04.26 | 2:4.3.11+dfsg-0ubuntu0.16.04.26 |
| samba | samba | >= 0 < 2:4.7.6+dfsg~ubuntu-0ubuntu2.16 | 2:4.7.6+dfsg~ubuntu-0ubuntu2.16 |
| samba | samba | >= 0 < 2:4.11.6+dfsg-0ubuntu1.1 | 2:4.11.6+dfsg-0ubuntu1.1 |
| samba | samba | >= 4.10.0 < 4.10.15 | 4.10.15 |
| samba | samba | >= 4.11.0 < 4.11.8 | 4.11.8 |
| samba | samba | >= 4.12.0 < 4.12.2 | 4.12.2 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2020-04-28·CVSS 5.3
CVE-2020-10700 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
Andrei Popa discovered that Samba incorrectly handled certain LDAP queries.
A remote attacker could use this issue to cause Samba to crash, resulting
in a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10700)
It was discovered that Samba incorrectly handled certain LDAP queries. A
remote attacker could possibly use this issue to cause Samba to consume
resources, resulting in a denial of service. (CVE-2020-10704)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
samba: Use-after-free in Samba AD DC LDAP Server with ASQ
vendor_redhat·2020-04-28·CVSS 5.3
CVE-2020-10700 [MEDIUM] CWE-416 samba: Use-after-free in Samba AD DC LDAP Server with ASQ
samba: Use-after-free in Samba AD DC LDAP Server with ASQ
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service.
Statement: This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux as there is no support for samba as an Active Directory Domain Controller (AD DC). Similarly, the version of samba shipped w
Debian
CVE-2020-10700: samba - A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Pa...
vendor_debian·2020·CVSS 5.3
CVE-2020-10700 [MEDIUM] CVE-2020-10700: samba - A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Pa...
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.
Scope: local
bookworm: resolved (fixed in 2:4.12.3+dfsg-2)
bullseye: resolved (fixed in 2:4.12.3+dfsg-2)
forky: resolved (fixed in 2:4.12.3+dfsg-2)
sid: resolved (fixed in 2:4.12.3+dfsg-2)
trixie: resolved (fixed in 2:4.12.3+dfsg-2)
GHSA
GHSA-7g79-5vjp-6w3f: A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control
ghsa_unreviewed·2022-05-24
CVE-2020-10700 [MEDIUM] CWE-416 GHSA-7g79-5vjp-6w3f: A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.
OSV
CVE-2020-10700: A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control
osv·2020-05-04·CVSS 5.3
CVE-2020-10700 [MEDIUM] CVE-2020-10700: A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.
OSV
samba vulnerabilities
osv·2020-04-28·CVSS 5.3
CVE-2020-10700 [MEDIUM] samba vulnerabilities
samba vulnerabilities
Andrei Popa discovered that Samba incorrectly handled certain LDAP queries.
A remote attacker could use this issue to cause Samba to crash, resulting
in a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10700)
It was discovered that Samba incorrectly handled certain LDAP queries. A
remote attacker could possibly use this issue to cause Samba to consume
resources, resulting in a denial of service. (CVE-2020-10704)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-10730 samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results
bugzilla·2020-06-22·CVSS 5.3
CVE-2020-10730 [MEDIUM] CVE-2020-10730 samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results
CVE-2020-10730 samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results
As per upstream advisory:
Samba has, since Samba 4.5, supported the VLV Active Directory LDAP feature, to allow clients to obtain 'virtual list views' of search results against a Samba AD DC using an LDAP control.
The combination of this control, and the ASQ control combines to allow an authenticated user to trigger a NULL-pointer de-reference. It is also possible to trigger a use-after-free, both as the code is very similar to that addressed by CVE-2020-10700 and due to the way errors are handled in the dsdb_paged_results module since Samba 4.10.
Discussion:
Acknowledgments:
Name: the Samba project
Upstream: Andrew Bartlett
---
Statement:
The version of sa
Bugzilla
CVE-2020-10700 samba: Use-after-free in Samba AD DC LDAP Server with ASQ [fedora-all]
bugzilla·2020-04-28·CVSS 5.3
CVE-2020-10700 [MEDIUM] CVE-2020-10700 samba: Use-after-free in Samba AD DC LDAP Server with ASQ [fedora-all]
CVE-2020-10700 samba: Use-after-free in Samba AD DC LDAP Server with ASQ [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2020-10700 samba: Use-after-free in Samba AD DC LDAP Server with ASQ
bugzilla·2020-04-20·CVSS 5.3
CVE-2020-10700 [MEDIUM] CVE-2020-10700 samba: Use-after-free in Samba AD DC LDAP Server with ASQ
CVE-2020-10700 samba: Use-after-free in Samba AD DC LDAP Server with ASQ
As per upstream advisory:
Samba has, since Samba 4.0, supported the Paged Results LDAP feature, to allow clients to obtain pages of search results against a Samba AD DC using an LDAP control.
Since Samba 4.7.11 and 4.8.6 a Denial of Service prevention has been in place in this module, to age out old client requests if more than 10 such requests are outstanding.
A rewrite of the module for more efficient memory handling in Samba 4.11 changed the module behaviour, and combined with the above to introduce the use-after-free. The use-after-free occurs when the 'Paged Results' control is combined with the 'ASQ' control, another Active Directory LDAP feature.
Discussion:
Acknowledgments:
Name: the Samba project
Upst
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5KW3ZO35NVDO57JSBZHTQZOS3AIQ5QE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WG54NRMES2GTURZKZH6H4BGXCD3OMJDJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7DVGCHG3XPIBQ5ETGMGW7MXNOO4HFH4/https://security.gentoo.org/glsa/202007-15https://www.samba.org/samba/security/CVE-2020-10700.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5KW3ZO35NVDO57JSBZHTQZOS3AIQ5QE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WG54NRMES2GTURZKZH6H4BGXCD3OMJDJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7DVGCHG3XPIBQ5ETGMGW7MXNOO4HFH4/https://security.gentoo.org/glsa/202007-15https://www.samba.org/samba/security/CVE-2020-10700.html
2020-05-04
Published