Vulnerability Description
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | >= 4.0.0, < 4.9.17 |
| Fedoraproject | Fedora | 30 |
| Canonical | Ubuntu Linux | 14.04 |
| Opensuse | Leap | 15.1 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.htmlMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/06/24/3
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00023.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202003-52Third Party Advisory
- https://security.netapp.com/advisory/ntap-20191210-0002/Third Party Advisory
- https://usn.ubuntu.com/4217-1/Third Party Advisory
- https://usn.ubuntu.com/4217-2/Third Party Advisory
- https://www.samba.org/samba/security/CVE-2019-14861.htmlVendor Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_40Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.htmlMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/06/24/3
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861Issue TrackingThird Party Advisory
FAQ
What is CVE-2019-14861?
CVE-2019-14861 is a vulnerability with a CVSS score of 5.3 (MEDIUM). All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS recor...
How severe is CVE-2019-14861?
CVE-2019-14861 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-14861?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba, Fedoraproject Fedora, Canonical Ubuntu Linux, Opensuse Leap, Debian Debian Linux.