Debian Samba vulnerabilities

CVE-2020-10730 [MEDIUM] CVE-2020-10730: ldb - A NULL pointer dereference, or possible use-after-free flaw was found in Samba A... A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigge

CVE-2019-3824 [MEDIUM] CVE-2019-3824: ldb - A flaw was found in the way an LDAP search expression could crash the shared LDA... A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service. Scope: local bullseye: resolved (fixed in 2:1.5.1+really1.4.3-2)

CVE-2019-10197 [MEDIUM] CVE-2019-10197: samba - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8... A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share. Scope: local bookworm: resolved (fixed in 2:4.9.13

CVE-2019-3870 [MEDIUM] CVE-2019-3870: samba - A vulnerability was found in Samba from version (including) 4.9 to versions befo... A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755,

CVE-2019-14833 [MEDIUM] CVE-2019-14833: samba - A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15... A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexit

CVE-2019-12435 [MEDIUM] CVE-2019-12435: samba - Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference... Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management server (dnsserver) RPC server process. Scope: local bookworm: resolved (fixed in 2:4.9.5+dfsg-5) bullseye: resolved (fixed in 2:4.9.5+dfsg-5) forky: resolved (fixed in 2:4.9.5+dfsg-5) sid: resolved (fixed in 2:4.

CVE-2019-3880 [MEDIUM] CVE-2019-3880: samba - A flaw was found in the way samba implemented an RPC endpoint emulating the Wind... A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable. Scope: local bookworm: resol

CVE-2019-14847 [MEDIUM] CVE-2019-14847: samba - A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10... A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue. Scope: local bookworm: resolved (fixed in 2:4.11.0+dfsg-6) bullseye: resolved (fixed in 2:4.11.0+dfsg-6) forky: resolved (fixed in 2:4.11.0+dfsg-

CVE-2019-14907 [MEDIUM] CVE-2019-14907: samba - All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before ... All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a l

CVE-2019-14870 [MEDIUM] CVE-2019-14870: heimdal - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before ... All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwar

CVE-2019-19344 [MEDIUM] CVE-2019-19344: samba - There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all s... There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer. Scope: local bookworm: resolved (fixed in 2:4.11.5+dfsg-1) bullseye: resolved (fixed in 2:4.11.5+dfsg-1)

CVE-2019-14902 [MEDIUM] CVE-2019-14902: samba - There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x v... There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers. Scope: local bookworm: resolved (fixed in 2:4.11.5+dfsg-1) bullseye: resolved (fixed in 2:4.11.

CVE-2019-10218 [MEDIUM] CVE-2019-10218: samba - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.... A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory

CVE-2019-14861 [MEDIUM] CVE-2019-14861: samba - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before ... All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authentic

CVE-2019-12436 [MEDIUM] CVE-2019-12436: samba - Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC L... Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2018-1139 [HIGH] CVE-2018-1139: samba - A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak... A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. Scope: local bookworm: resolved (fixed in 2:4.8.4+dfsg-1) bullseye: resolved (fixed in 2:4.8.

CVE-2018-16857 [HIGH] CVE-2018-16857: samba - Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations... Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing

CVE-2018-16860 [HIGH] CVE-2018-16860: heimdal - A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, ex... A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that

CVE-2018-1057 [HIGH] CVE-2018-1057: samba - On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards i... On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers). Scope: local bookworm: resolved (fixed in 2:4.7.4+dfsg-2) bullseye: resolv

CVE-2018-1050 [MEDIUM] CVE-2018-1050: samba - All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service a... All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash. Scope: local bookworm: resolved (fixed in 2:4.7.4+dfsg-2) bullseye: resol