Log in Start free

Vulnerability · Published Jul 7, 2020 · Assigned by redhat

CVE-2020-10730

Medium 6.5

In plain English

A medium-severity security flaw in Samba. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)2.5%top 15.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20samba4.12.5-r0ALPINE-CVE-2020-10730
Alpine:v3.21samba4.12.5-r0ALPINE-CVE-2020-10730
Alpine:v3.22samba4.12.5-r0ALPINE-CVE-2020-10730
Alpine:v3.23samba4.12.5-r0ALPINE-CVE-2020-10730
Alpine:v3.24samba4.12.5-r0ALPINE-CVE-2020-10730
Debian:12samba2:4.12.5+dfsg-1DEBIAN-CVE-2020-10730
Debian:13samba2:4.12.5+dfsg-1DEBIAN-CVE-2020-10730
Debian:14samba2:4.12.5+dfsg-1DEBIAN-CVE-2020-10730

Affected products (as reported)

VendorProductVersions
n/a Samba All Samba versions before 4.10.17, before 4.11.11 and before 4.12.4

References