CVE-2021-3671

Опубликовано: 12 окт. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=2013080%2C
https://bugzilla.samba.org/show_bug.cgi?id=14770%2C
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221215-0002/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230216-0008/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5287
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2013080%2C
https://bugzilla.samba.org/show_bug.cgi?id=14770%2C
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221215-0002/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230216-0008/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5287
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия до 4.13.12 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.14.0 (включая) до 4.14.8 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01131

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-476

Связанные уязвимости

CVE-2021-3671

CVSS3: 6.5

ubuntu

почти 4 года назад

CVE-2021-3671

CVSS3: 6.5

redhat

почти 4 года назад

CVE-2021-3671

CVSS3: 6.5

msrc

10 месяцев назад

Описание отсутствует

CVE-2021-3671

CVSS3: 6.5

debian

почти 4 года назад

A null pointer de-reference was found in the way samba kerberos server ...

GHSA-ghqf-jx44-h9c5

CVSS3: 6.5

github

около 3 лет назад

EPSS

Процентиль: 77%

0.01131

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-476