CVE-2020-14383

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
redhatCNA
---
---
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
VendorProductVersion
sambasamba
4.0.0 ≤
𝑥
< 4.11.15
sambasamba
4.12.0 ≤
𝑥
< 4.12.9
sambasamba
4.13.0 ≤
𝑥
< 4.13.1
redhatenterprise_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
samba
bullseye (security)
2:4.13.13+dfsg-1~deb11u6
fixed
bullseye
2:4.13.13+dfsg-1~deb11u6
fixed
bookworm
2:4.17.12+dfsg-0+deb12u1
fixed
bookworm (security)
2:4.17.12+dfsg-0+deb12u1
fixed
sid
2:4.21.1+dfsg-2
fixed
trixie
2:4.21.1+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
samba
hirsute
Fixed 2:4.12.5+dfsg-3ubuntu4.1
released
groovy
Fixed 2:4.12.5+dfsg-3ubuntu4.1
released
focal
Fixed 2:4.11.6+dfsg-0ubuntu1.6
released
bionic
Fixed 2:4.7.6+dfsg~ubuntu-0ubuntu2.21
released
xenial
Fixed 2:4.3.11+dfsg-0ubuntu0.16.04.32
released
trusty
Fixed 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm11
released
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1892636
https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html
https://security.gentoo.org/glsa/202012-24
https://www.samba.org/samba/security/CVE-2020-14383.html
https://bugzilla.redhat.com/show_bug.cgi?id=1892636
https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html
https://security.gentoo.org/glsa/202012-24
https://www.samba.org/samba/security/CVE-2020-14383.html