Unscored severity · published May 28, 2014
CVE-2014-0239
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote…
–
CVSS
66.8%
EPSS
No
On KEV
Description
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.
Exploitation
Is it being used?
Exploit prediction (EPSS)66.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Samba · Samba
4.0.0 before 4.0.18; 4.1.0 before 4.1.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0239
Third Party Advisory
http://secunia.com/advisories/59579
Third Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xml
Vendor Advisory
http://www.samba.org/samba/security/CVE-2014-0239
Third Party Advisory
http://www.securityfocus.com/bid/67691
Third Party Advisory
http://www.securitytracker.com/id/1030309
More from Samba
9.8
CVE-2017-7494
Samba Remote Code Execution Vulnerability
5.5
CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2023-3961
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
9.8
CVE-2022-45141
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable…