CVE-2020-14303: High severity samba vulnerability
A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.
Other sources
As per upstream advisory:
The NetBIOS over TCP/IP name resolution protocol is implemented as a UDP datagram on port 137.
The AD DC client and server-side processing code for NBT name resolution will enter a tight loop if a UDP packet with 0 data length is received. The client for this case is only found in the AD DC side of the codebase, not that used by the the member server or file server.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-14303?
CVE-2020-14303 is a vulnerability found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11, and before 4.12.4.
What is the severity of CVE-2020-14303?
The severity of CVE-2020-14303 is high, with a severity value of 7.5.
How does CVE-2020-14303 affect Samba?
CVE-2020-14303 in Samba allows a user to send an empty UDP packet, causing the Samba server to crash.
Which versions of Samba are affected by CVE-2020-14303?
All Samba versions before 4.10.17, before 4.11.11, and before 4.12.4 are affected by CVE-2020-14303.
Where can I find more information about CVE-2020-14303?
You can find more information about CVE-2020-14303 at the following references: [1], [2], [3].