CVE-2019-14847: A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10

Medium severity · published Nov 6, 2019

CVE-2019-14847

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10

4.9

CVSS

2.1%

EPSS

On KEV

Description

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.1% · higher than 82% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Fedora · Fedoraproject

29; 30 · source: NVD

Leap · Opensuse

15.0 · source: NVD

Samba · Samba

4.0.0 before 4.9.15; 4.10.0 before 4.10.10 · source: NVD

Affected product

Fedora

Fedoraproject

All Fedora CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-14847

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-14847

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html

Exploit

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14847

lists.debian.org

https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html

lists.debian.org

https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/