CVE-2023-42669
published 2023-11-06CVE-2023-42669: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.72%
74.9th percentile
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.17.12+dfsg-0+deb12u1 (bookworm) | samba 2:4.17.12+dfsg-0+deb12u1 (bookworm) |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems_eus | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian_eus | — | — |
| redhat | storage | — | — |
| samba | samba | >= 0 < 2:4.17.12+dfsg-0+deb12u1 | 2:4.17.12+dfsg-0+deb12u1 |
| samba | samba | >= 0 < 2:4.19.1+dfsg-1 | 2:4.19.1+dfsg-1 |
| samba | samba | >= 0 < 2:4.19.1+dfsg-1 | 2:4.19.1+dfsg-1 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu0.20.04.7 | 2:4.15.13+dfsg-0ubuntu0.20.04.7 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu0.20.04.6 | 2:4.15.13+dfsg-0ubuntu0.20.04.6 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu1.5 | 2:4.15.13+dfsg-0ubuntu1.5 |
| samba | samba | >= 0 < 2:4.18.6+dfsg-1ubuntu2.1 | 2:4.18.6+dfsg-1ubuntu2.1 |
| samba | samba | >= 4.0.0 < 4.17.12 | 4.17.12 |
| samba | samba | >= 4.18.0 < 4.18.8 | 4.18.8 |
| samba | samba | >= 4.19.0 < 4.19.1 | 4.19.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-42669: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements
osv·2023-11-06·CVSS 6.5
CVE-2023-42669 [MEDIUM] CVE-2023-42669: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects
GHSA
GHSA-8q58-8vm2-mf3q: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements
ghsa_unreviewed·2023-11-06
CVE-2023-42669 [MEDIUM] CWE-400 GHSA-8q58-8vm2-mf3q: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects
OSV
samba vulnerabilities
osv·2023-10-17·CVSS 6.5
CVE-2023-4091 [MEDIUM] samba vulnerabilities
samba vulnerabilities
USN-6425-1 fixed vulnerabilities in Samba. This update provides the
corresponding updates for Ubuntu 23.10.
Original advisory details:
Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)
Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)
Andrew Bartlett discovered that Samba incorrectly handled the rpcecho
development server. A remote attacker could possibly use this issue to
cause Samba to stop responding, resulting in a denial o
OSV
samba regression
osv·2023-10-11·CVSS 6.5
[MEDIUM] samba regression
samba regression
USN-6425-1 fixed vulnerabilities in Samba. Due to a build issue on Ubuntu
20.04 LTS, the update introduced regressions in macro handling and
possibly other functionality.
This update fixes the problem. We apologize for the inconvenience.
Original advisory details:
Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)
Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)
Andrew Bartlett discovered that Samba incorrectly handled the rpcecho
OSV
samba vulnerabilities
osv·2023-10-10·CVSS 6.5
CVE-2023-4091 [MEDIUM] samba vulnerabilities
samba vulnerabilities
Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)
Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)
Andrew Bartlett discovered that Samba incorrectly handled the rpcecho
development server. A remote attacker could possibly use this issue to
cause Samba to stop responding, resulting in a denial of service.
(CVE-2023-42669)
Kirin van der Veer discovered that Samba incorrectly handled certain RPC
service listeners. A remote attacke
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2023-10-17·CVSS 6.5
CVE-2023-42669 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
USN-6425-1 fixed vulnerabilities in Samba. This update provides the
corresponding updates for Ubuntu 23.10.
Original advisory details:
Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)
Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)
Andrew Bartlett discovered that Samba incorrectly handled the rpcecho
development server. A remote attacker could possibly use this is
Ubuntu
Samba regression
vendor_ubuntu·2023-10-11·CVSS 6.5
[MEDIUM] Samba regression
Title: Samba regression
Summary: USN-6425-1 introduced a regression in Samba.
USN-6425-1 fixed vulnerabilities in Samba. Due to a build issue on Ubuntu
20.04 LTS, the update introduced regressions in macro handling and
possibly other functionality.
This update fixes the problem. We apologize for the inconvenience.
Original advisory details:
Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)
Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)
Andrew B
Red Hat
samba: "rpcecho" development server allows denial of service via sleep() call on AD DC
vendor_redhat·2023-10-10·CVSS 6.5
CVE-2023-42669 [MEDIUM] CWE-400 samba: "rpcecho" development server allows denial of service via sleep() call on AD DC
samba: "rpcecho" development server allows denial of service via sleep() call on AD DC
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2023-10-10·CVSS 6.5
CVE-2023-4091 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)
Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)
Andrew Bartlett discovered that Samba incorrectly handled the rpcecho
development server. A remote attacker could possibly use this issue to
cause Samba to stop responding, resulting in a denial of service.
(CVE-2023-42669)
Kirin van der Veer discovered that Samba incor
Debian
CVE-2023-42669: samba - A vulnerability was found in Samba's "rpcecho" development server, a non-Windows...
vendor_debian·2023·CVSS 6.5
CVE-2023-42669 [MEDIUM] CVE-2023-42669: samba - A vulnerability was found in Samba's "rpcecho" development server, a non-Windows...
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2023:6209https://access.redhat.com/errata/RHSA-2023:6744https://access.redhat.com/errata/RHSA-2023:7371https://access.redhat.com/errata/RHSA-2023:7408https://access.redhat.com/errata/RHSA-2023:7464https://access.redhat.com/errata/RHSA-2023:7467https://access.redhat.com/security/cve/CVE-2023-42669https://bugzilla.redhat.com/show_bug.cgi?id=2241884https://bugzilla.samba.org/show_bug.cgi?id=15474https://www.samba.org/samba/security/CVE-2023-42669.htmlhttps://access.redhat.com/errata/RHSA-2023:6209https://access.redhat.com/errata/RHSA-2023:6744https://access.redhat.com/errata/RHSA-2023:7371https://access.redhat.com/errata/RHSA-2023:7408https://access.redhat.com/errata/RHSA-2023:7464https://access.redhat.com/errata/RHSA-2023:7467https://access.redhat.com/security/cve/CVE-2023-42669https://bugzilla.redhat.com/show_bug.cgi?id=2241884https://bugzilla.samba.org/show_bug.cgi?id=15474https://security.netapp.com/advisory/ntap-20231124-0002/https://www.samba.org/samba/security/CVE-2023-42669.html
2023-11-06
Published