CVE-2015-5330

ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ldb	17.04 zesty	Fixed 2:1.1.24-1ubuntu1
	16.10 yakkety	Fixed 2:1.1.24-1ubuntu1
	16.04 LTS xenial	Fixed 2:1.1.24-1ubuntu1
	15.10 wily	Fixed 2:1.1.20-2ubuntu0.1
	15.04 vivid	Fixed 1:1.1.18-1ubuntu0.1
	14.04 LTS trusty	Fixed 1:1.1.16-1ubuntu0.1
	12.04 LTS precise	Fixed 1:1.1.4-1ubuntu0.1
samba	17.04 zesty	Fixed 2:4.3.3+dfsg-1ubuntu1
	16.10 yakkety	Fixed 2:4.3.3+dfsg-1ubuntu1
	16.04 LTS xenial	Fixed 2:4.3.3+dfsg-1ubuntu1
	15.10 wily	Fixed 2:4.1.17+dfsg-4ubuntu3.1
	15.04 vivid	Fixed 2:4.1.13+dfsg-4ubuntu3.1
	14.04 LTS trusty	Fixed 2:4.1.6+dfsg-1ubuntu2.14.04.11
	12.04 LTS precise	Fixed 2:3.6.3-2ubuntu2.13
samba4	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	15.10 wily	Not in release
	15.04 vivid	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Ignored end of life

Notes

mdeslaur

4.0.0 to 4.3.2, but 3.6 may also need patch may require ldb-1.1.24 3.6 patch in upstream bug

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
samba	Upstream: https://git.samba.org/?p=samba.git;a=commit;h=1aef718f3cc175d90d40202a333042a38ba382b1 Upstream: https://git.samba.org/?p=samba.git;a=commit;h=7bcac237656083e67bbac9b50be9b319bb2d7eb8 Upstream: https://git.samba.org/?p=samba.git;a=commit;h=5f3c7541c2f10ac2174538288f6569af587d69f0 Upstream: https://git.samba.org/?p=samba.git;a=commit;h=a561ae6294fa926bf3a15b9aaf3d18d25d5e971f Upstream: https://git.samba.org/?p=samba.git;a=commit;h=f07626d0297ed6bd21623409e1ea1ae1138d23a8 Upstream: https://git.samba.org/?p=samba.git;a=commit;h=83f1d39cd9ab9b8b548602f9ee806a994fca9d0c

Package

Patch details

samba

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Cvss 3 Severity Score

Status

Notes

mdeslaur

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references