CVE-2015-7540

Опубликовано: 29 дек. 2015

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html
Mailing List
Third Party Advisory
http://www.debian.org/security/2016/dsa-3433
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Third Party Advisory
http://www.securityfocus.com/bid/79736
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034492
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2855-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-2855-2
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1288451
Issue Tracking
Third Party Advisory
https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=530d50a1abdcdf4d1775652d4c456c1274d83d8d
https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=9d989c9dd7a5b92d0c5d65287935471b83b6e884
https://security.gentoo.org/glsa/201612-47
Third Party Advisory
https://www.samba.org/samba/security/CVE-2015-7540.html
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html
Mailing List
Third Party Advisory
http://www.debian.org/security/2016/dsa-3433
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Third Party Advisory
http://www.securityfocus.com/bid/79736
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.1.22 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.0991

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-399

Связанные уязвимости

CVE-2015-7540

CVSS3: 7.5

ubuntu

почти 10 лет назад

CVE-2015-7540

redhat

почти 10 лет назад

CVE-2015-7540

CVSS3: 7.5

debian

почти 10 лет назад

The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 ...

GHSA-7m2w-hp2f-cmqp

CVSS3: 7.5

github

больше 3 лет назад

BDU:2021-01295

CVSS3: 7.5

fstec

почти 10 лет назад

Уязвимость LDAP-сервера пакета программ сетевого взаимодействия Samba, связанная с ошибкой механизма управления ресурсами системы, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 93%

0.0991

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-399