CVE-2020-27840: High severity samba vulnerability
A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.
Other sources
As per upstream:
A DN may be represented in string form with arbitrary amounts of space around the component values. These spaces are supposed to be ignored, but invalid DNs strings with spaces may instead cause a zero byte to be written into out-of-bounds memory.
An LDAP bind request can send a string DN as a username. This DN is necessarily parsed before the password is checked, so an attacker without real credentials can anonymously trigger this bug.
The location of zero byte is a negative offset relative to the location of a dynamically allocated heap buffer; the exact offset depends on the DN string. While it is possible for an attacker to cause non-fatal data corruption, usefully targeting this is likely to be difficult and the most likely outcome is a crash.
The affected parsing routine is widely used. LDAP bind is not the only way to trigger the bug remotely, though it appears to be the only unauthenticated method.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27840?
CVE-2020-27840 is a vulnerability found in Samba that allows spaces used in a string around a domain name to write a zero-byte into out-of-bounds memory, resulting in a crash.
What is the severity of CVE-2020-27840?
The severity of CVE-2020-27840 is high, with a severity value of 7.5.
Which software is affected by CVE-2020-27840?
Samba versions 4.0.0 to 4.12.13, 4.13.0 to 4.13.6, and 4.14.0 to 4.14.1 are affected, as well as Debian Linux 9.0 and 10.0 and Fedora 32, 33, and 34.
How can I fix CVE-2020-27840?
To fix CVE-2020-27840, update Samba to versions 4.9.5+dfsg-5+deb10u4, 4.13.13+dfsg-1~deb11u5, 4.17.11+dfsg-0+deb12u1, or later.
Where can I find more information about CVE-2020-27840?
You can find more information about CVE-2020-27840 at the following references: [Bugzilla](https://bugzilla.samba.org/show_bug.cgi?id=14595), [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2020-27840), [MITRE CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27840).