Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-0239: Samba 4.x internal DNS server can be crashed by fake responses

CVE-2014-0239 · published 12 years ago

Summary

An attacker can send fake DNS responses to a Samba 4.x server, causing it to consume excessive CPU and bandwidth. This can make the server unusable. To fix this, update Samba 4.x to version 4.0.18 or later.

What to do

Update debian samba to version 2:4.1.8+dfsg-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	samba	< 2:4.1.8+dfsg-1 Fix: upgrade to 2:4.1.8+dfsg-1
Debian:12	debian	samba	< 2:4.1.8+dfsg-1 Fix: upgrade to 2:4.1.8+dfsg-1
Debian:13	debian	samba	< 2:4.1.8+dfsg-1 Fix: upgrade to 2:4.1.8+dfsg-1
Debian:14	debian	samba	< 2:4.1.8+dfsg-1 Fix: upgrade to 2:4.1.8+dfsg-1
–	samba	samba	>= 4.0.0, < 4.0.18 >= 4.1.0, < 4.1.8 `cpe:2.3:a:samba:samba::::::::`

Original advisory text

The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.

References

https://security-tracker.debian.org/tracker/CVE-2014-0239 Vendor Advisory
http://secunia.com/advisories/59579 Third Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xml Third Party Advisory
http://www.samba.org/samba/security/CVE-2014-0239 Vendor Advisory
http://www.securityfocus.com/bid/67691 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030309 Third Party Advisory VDB Entry

Severity

5.0 Medium

Exploitation

67% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published28 May 2014

Updated29 Sep 2026

First seen8 Aug 2026

Sources

DEBIAN-CVE-2014-0239 · OSV

CVE-2014-0239 · NVD

Track software like this

Free during beta