Debian LTS: Security Advisory for samba (DLA-2463-1)

The remote host is missing an update for the 'samba' package(s) announced via the DLA-2463-1 advisory.

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. CVE-2020-1472 Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations. CVE-2020-10704 An unauthorized user can trigger a denial of service via a stack overflow in the AD DC LDAP server. CVE-2020-10730 NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results. CVE-2020-10745 Denial of service resulting from abuse of compression of replies to NetBIOS over TCP/IP name resolution and DNS packets causing excessive CPU load on the Samba AD DC. CVE-2020-10760 The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free. CVE-2020-14303 Denial of service resulting from CPU spin and and inability to process further requests once the AD DC NBT server receives an empty (zero-length) UDP packet to port 137. CVE-2020-14318 Missing handle permissions check in ChangeNotify CVE-2020-14323 Unprivileged user can crash winbind via invalid lookupsids DoS CVE-2020-14383 DNS server crash via invalid records resulting from uninitialized variables

'samba' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 stretch, these problems have been fixed in version 2:4.5.16+dfsg-1+deb9u3. We recommend that you upgrade your samba packages.