CVE-2023-42669: Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc
First published: Tue Oct 03 2023(Updated: )
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Samba Samba | >=4.0.0<4.17.12 | |
| Samba Samba | >=4.18.0<4.18.8 | |
| Samba Samba | >=4.19.0<4.19.1 | |
| Redhat Storage | =3.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =9.0 | |
| Redhat Enterprise Linux Eus | =9.0 | |
| Redhat Enterprise Linux For Ibm Z Systems | =9.0_s390x | |
| Redhat Enterprise Linux For Ibm Z Systems Eus | =9.0_s390x | |
| Redhat Enterprise Linux For Power Little Endian | =9.0_ppc64le | |
| Redhat Enterprise Linux For Power Little Endian Eus | =9.0_ppc64le | |
| redhat/samba | <4.19.1 | 4.19.1 |
| redhat/samba | <4.18.8 | 4.18.8 |
| redhat/samba | <4.17.12 | 4.17.12 |
| ubuntu/samba | <2:4.15.13+dfsg-0ubuntu0.20.04.6 | 2:4.15.13+dfsg-0ubuntu0.20.04.6 |
| ubuntu/samba | <2:4.15.13+dfsg-0ubuntu1.5 | 2:4.15.13+dfsg-0ubuntu1.5 |
| ubuntu/samba | <2:4.17.7+dfsg-1ubuntu2.3 | 2:4.17.7+dfsg-1ubuntu2.3 |
| ubuntu/samba | <2:4.18.6+dfsg-1ubuntu2.1 | 2:4.18.6+dfsg-1ubuntu2.1 |
| debian/samba | <=2:4.9.5+dfsg-5+deb10u3<=2:4.9.5+dfsg-5+deb10u5<=2:4.13.13+dfsg-1~deb11u5<=2:4.13.13+dfsg-1~deb11u6 | 2:4.17.12+dfsg-0+deb12u1 2:4.19.5+dfsg-1 2:4.19.6+dfsg-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2023:6209
- https://access.redhat.com/errata/RHSA-2023:6744
- https://access.redhat.com/errata/RHSA-2023:7371
- https://access.redhat.com/errata/RHSA-2023:7408
- https://access.redhat.com/errata/RHSA-2023:7464
- https://access.redhat.com/errata/RHSA-2023:7467
- https://access.redhat.com/security/cve/CVE-2023-42669
- https://bugzilla.redhat.com/show_bug.cgi?id=2241884
- https://bugzilla.samba.org/show_bug.cgi?id=15474
- https://security.netapp.com/advisory/ntap-20231124-0002/
- https://www.samba.org/samba/security/CVE-2023-42669.html
- https://launchpad.net/bugs/cve/CVE-2023-42669
- https://security-tracker.debian.org/tracker/CVE-2023-42669
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2243229
- https://ubuntu.com/security/notices/USN-6425-1
- https://ubuntu.com/security/notices/USN-6425-3
- https://www.cve.org/CVERecord?id=CVE-2023-42669
- https://nvd.nist.gov/vuln/detail/CVE-2023-42669
- https://ubuntu.com/security/CVE-2023-42669
Frequently Asked Questions
What is the vulnerability ID for rpcecho development server Denial of Service vulnerability?
The vulnerability ID for rpcecho development server Denial of Service vulnerability is CVE-2023-42669.
What is the impact of the rpcecho development server Denial of Service vulnerability?
The rpcecho development server Denial of Service vulnerability can lead to a Denial of Service attack on the Active Directory Domain Controller (AD DC).
Which software is affected by the rpcecho development server Denial of Service vulnerability?
The samba package versions 2:4.15.13+dfsg-0ubuntu0.20.04.6, 2:4.15.13+dfsg-0ubuntu1.5, and 2:4.17.7+dfsg-1ubuntu2.3 are affected by the rpcecho development server Denial of Service vulnerability.
How can I fix the rpcecho development server Denial of Service vulnerability?
To fix the rpcecho development server Denial of Service vulnerability, update the samba package to version 2:4.15.13+dfsg-0ubuntu0.20.04.6, 2:4.15.13+dfsg-0ubuntu1.5, or 2:4.17.7+dfsg-1ubuntu2.3, depending on the affected version.
Where can I find more information about the rpcecho development server Denial of Service vulnerability?
You can find more information about the rpcecho development server Denial of Service vulnerability on the MITRE CVE website, Samba website, and the Ubuntu Security Notices website.
- collector/nvd-api
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/references
- agent/title
- agent/severity
- agent/description
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-42669
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- vendor/samba
- canonical/samba samba
- version/samba samba/4.0.0
- version/samba samba/4.18.0
- version/samba samba/4.19.0
- vendor/redhat
- canonical/redhat storage
- version/redhat storage/3.0
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- version/redhat enterprise linux/9.0
- canonical/redhat enterprise linux eus
- version/redhat enterprise linux eus/9.0
- canonical/redhat enterprise linux for ibm z systems
- version/redhat enterprise linux for ibm z systems/9.0_s390x
- canonical/redhat enterprise linux for ibm z systems eus
- version/redhat enterprise linux for ibm z systems eus/9.0_s390x
- canonical/redhat enterprise linux for power little endian
- version/redhat enterprise linux for power little endian/9.0_ppc64le
- canonical/redhat enterprise linux for power little endian eus
- version/redhat enterprise linux for power little endian eus/9.0_ppc64le
- package-manager/debian
- package-manager/redhat
- package-manager/ubuntu