Denial of Service Vulnerability in Samba Package - CVE-2019-12435
Summary
ALPINE-CVE-2019-12435: Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. Affects samba versions < 4.10.5-r0. Fixed in 4.10.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Samba is an open-source software suite that provides seamless file and print services to SMB/CIFS clients. It enables interoperability between Linux/Unix servers and Windows-based clients. Samba is widely used for sharing files and printers across different operating systems. The vulnerability in question affects versions of Samba prior to 4.10.5, which can lead to a denial of service due to a NULL pointer dereference in the AD DC DNS management server.
Vulnerability Detail
The vulnerability identified as CVE-2019-12435 is a NULL pointer dereference found in Samba versions 4.9.x before 4.9.9 and 4.10.x before 4.10.5. This flaw can be exploited to cause a denial of service, rendering the affected Samba server unresponsive. The issue arises in the RPC server process responsible for DNS management, which can be targeted by attackers to disrupt services.
How To Fix
Minimum fixed version
4.10.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the DNS management features of the Samba server until the package can be updated. This can be done by modifying the Samba configuration file (smb.conf) to disable the DNS server functionality.
Conclusion
CVE-2019-12435 represents a significant vulnerability in the Samba package that can lead to denial of service. It is crucial for users to update to the patched version to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for samba →
FAQ
CVE-2019-12435 is a vulnerability in Samba that can lead to a denial of service due to a NULL pointer dereference.
Samba versions 4.9.x before 4.9.9 and 4.10.x before 4.10.5 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-12435 is 6.5, indicating a medium severity level.
If an immediate update is not possible, consider disabling the DNS management features in the Samba configuration as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for samba.
