CVE-2020-10730

samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Se encontró una desreferencia del puntero NULL, o un posible fallo de uso de la memoria previamente liberada en el servidor LDAP de Samba AD en versiones anteriores a 4.10.17, anteriores a 4.11.11 y anteriores a 4.12.4. Aunque algunas versiones de Samba incluidas con Red Hat Enterprise Linux no son compatibles con Samba en modo AD, el código afectado se incluye con el paquete libldb. Este fallo permite a un usuario autenticado desencadenar posiblemente una desreferencia del puntero NULL o un uso de la memoria previamente liberada. La mayor amenaza de esta vulnerabilidad es la disponibilidad del sistema

A NULL pointer dereference, or possible use-after-free flaw was found in the Samba AD LDAP server. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-03-20 CVE Reserved
2020-07-02 CVE Published
2024-08-04 CVE Updated
2024-10-31 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-416: Use After Free
CWE-476: NULL Pointer Dereference

CAPEC

References (12)

URL	Tag	Source
https://bugzilla.redhat.com/show_bug.cgi?id=1849489%3B	X_refsource_misc
https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html	Issue Tracking

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00000.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YLNQ5GRXUKYRUAOFZ4DUBVN4SMTL6Q2	2023-11-07
https://security.gentoo.org/glsa/202007-15	2023-11-07
https://www.debian.org/security/2021/dsa-4884	2023-11-07
https://www.samba.org/samba/security/CVE-2020-10730.html	2023-11-07
https://access.redhat.com/security/cve/CVE-2020-10730	2020-11-04
https://bugzilla.redhat.com/show_bug.cgi?id=1849489	2020-11-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				>= 4.5.0 < 4.10.17 Search vendor "Samba" for product "Samba" and version " >= 4.5.0 < 4.10.17"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				>= 4.11.0 < 4.11.11 Search vendor "Samba" for product "Samba" and version " >= 4.11.0 < 4.11.11"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				>= 4.12.0 < 4.12.4 Search vendor "Samba" for product "Samba" and version " >= 4.12.0 < 4.12.4"		-		Affected
Redhat Search vendor "Redhat"		Storage Search vendor "Redhat" for product "Storage"				3.0 Search vendor "Redhat" for product "Storage" and version "3.0"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.1 Search vendor "Opensuse" for product "Leap" and version "15.1"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.2 Search vendor "Opensuse" for product "Leap" and version "15.2"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				31 Search vendor "Fedoraproject" for product "Fedora" and version "31"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected