CVE-2020-10745: High severity Samba Samba vulnerability
A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability.
Other sources
As per upstream advisory:
The NetBIOS over TCP/IP name resolution protocol is framed using the same format as DNS, and Samba's packing code for both uses DNS name compression.
An attacker can choose a name which, when the name is included in the reply, causes the DNS name compression algorithm to walk a very long internal list while trying to compress the reply. This in in part because the traditional "." separator in DNS is not actually part of the DNS protocol, the limit of 128 components is exceeded by including "." inside the components.
Specifically, the longest label is 63 characters, and Samba enforces a limit of 128 components. That means you can make a query for the address with 127 components, each of which is "...............................................................".
In processing that query, Samba rewrites the name in dot-separated form, then converts it back to the wire format in order to reply. Unfortunately for Samba, it now finds the name is just 8127 dots, which it duly converts into over 8127 zero length labels.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10745?
CVE-2020-10745 is a vulnerability found in all Samba versions before 4.10.17, before 4.11.11, and before 4.12.4, which allows a remote attacker to cause the Samba server to consume excessive CPU use, resulting in a denial of service.
What is the severity of CVE-2020-10745?
The severity of CVE-2020-10745 is high with a CVSS score of 7.5.
How does CVE-2020-10745 affect Samba?
CVE-2020-10745 affects all Samba versions before 4.10.17, before 4.11.11, and before 4.12.4.
How can I fix CVE-2020-10745?
To fix CVE-2020-10745, you should update your Samba software to version 4.10.17 or later, 4.11.11 or later, or 4.12.4 or later.
Where can I find more information about CVE-2020-10745?
You can find more information about CVE-2020-10745 in the references provided: [link1], [link2], [link3].