CVE-2019-14907 Denial of service in samba

Medium 6.5 Published 21 Jan 2020 Updated 5 Aug 2024

Attackers can crash long-lived Samba AD DC processes by sending crafted NTLMSSP strings when high log levels are enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-14907?

CVE-2019-14907 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 21 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

Weakness: CWE-125

Which versions are affected by CVE-2019-14907?

It affects 10 products.

Linux distribution packages (40)

`libsmbclient` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`libsmbclient-devel` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`libwbclient` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`libwbclient-devel` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-client` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-client-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-common` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-common-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-common-tools` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-dc` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-dc-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-devel` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-krb5-printing` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-pidl` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-python` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-python-test` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-test` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-test-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-vfs-glusterfs` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-winbind` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-winbind-clients` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-winbind-krb5-locator` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`samba-winbind-modules` Red Hat:enterprise_linux:7::client	All versions	`0:4.10.16-5.el7`
`libsmbclient` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`libsmbclient-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`libwbclient` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`libwbclient-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-client` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-client-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-common` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-common-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-common-tools` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-dc` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-dc-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`
`samba-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.10.16-5.el7`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Storage, Samba Samba and 4 more.

How do I fix CVE-2019-14907?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-14907 being exploited?

There is no known exploitation of CVE-2019-14907 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-14907, DEBIAN-CVE-2019-14907, ECHO-c032-e81f-5ad9, GHSA-qw9p-wf2h-j96q, RHSA-2020:3981, SUSE-SU-2020:0152-1 and 2 more.