Denial of Service Vulnerability in Samba Package - CVE-2019-14847
Summary
ALPINE-CVE-2019-14847: A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. Affects samba versions < 4.10.10-r0. Fixed in 4.10.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Samba is an open-source software suite that provides seamless file and print services to SMB/CIFS clients. It enables interoperability between Linux/Unix servers and Windows-based clients. The package is widely used for sharing files and printers across different operating systems. However, certain versions of Samba are vulnerable to a denial of service attack, which can disrupt its functionality.
Vulnerability Detail
A flaw was discovered in Samba versions prior to 4.9.15 and 4.10.x before 4.10.10. An attacker can exploit this vulnerability by crashing the Active Directory Domain Controller (AD DC) LDAP server through a directory synchronization (dirsync) request. This results in a denial of service, meaning legitimate users cannot access the services provided by Samba. Importantly, this vulnerability does not allow for privilege escalation.
How To Fix
Minimum fixed version
4.10.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the dirsync functionality if it is not essential for your operations. This can help prevent potential exploitation until the package is updated.
Conclusion
CVE-2019-14847 is a significant vulnerability in the Samba package that can lead to denial of service. It is crucial for users to update their Samba installations to the patched versions to ensure continued service availability and security.
See every vulnerability recorded for samba →
FAQ
CVE-2019-14847 is a vulnerability in Samba that allows an attacker to crash the AD DC LDAP server, leading to a denial of service.
Samba versions prior to 4.9.15 and 4.10.x before 4.10.10 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without requiring access to the code. Visit Vulert Scanner to check if your application is affected.
The CVSS score for CVE-2019-14847 is 4.9, indicating a medium severity level.
No, this vulnerability does not allow for privilege escalation; it only results in denial of service.
References
Related vulnerabilities
Recent vulnerabilities recorded for samba.
