CVE-2019-14907

Katalog CVE

CVSS 6.5 · Medium EPSS 3,2%

Kerentanan Out-of-bounds Read pada samba, fedoraproject fedora +8 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

Rincian

Terbit di NVD

21 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.samba.org/samba/security/CVE-2019-14907.html advisory vendor
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14907 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202003-52 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200122-0001/ advisory pihak ketiga
• https://usn.ubuntu.com/4244-1/ advisory pihak ketiga
• https://www.synology.com/security/advisory/Synology_SA_20_01 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ACZVNMIFQGGX...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQ6U65I2K23YJ...