Vulnerability in Samba Package (CVE-2020-27840)
Summary
CVE-2020-27840: A flaw was found in samba. Affects samba across 2 version ranges.
< 4.12.14-r0
>= df33344d8eb40221d60c99931690703a11d91bc2, < bb2f64babf1a2bfb780d0325e859f796d0ce1647
Fixed in 4.12.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Samba package is an open-source software suite that provides file and print services for various operating systems, including Windows, Linux, and macOS. It allows seamless integration of these systems into a network environment. However, a vulnerability has been discovered in Samba that can lead to a system crash due to invalid DN strings with spaces. This vulnerability can impact system availability.
Vulnerability Detail
The flaw in Samba arises when spaces are used in a string around a domain name (DN). Although these spaces are supposed to be ignored, they can cause invalid DN strings with spaces to write a zero-byte into out-of-bounds memory. As a result, the system crashes. The highest threat from this vulnerability is to system availability. The vulnerability has a CVSS score of 7.5.
How To Fix
Minimum fixed version
4.12.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Samba package is vulnerable to a flaw that can cause a system crash. It is crucial to update the package to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for samba →
FAQ
The vulnerability can cause a system crash, leading to system unavailability.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
The vulnerability affects Samba versions 0 to 4.14.2-r0.
There are no known exploits for this vulnerability at the moment.
For more detailed information about this vulnerability, you can refer to the source link provided in the database_specific field.
Related vulnerabilities
Recent vulnerabilities recorded for samba.
