CVE-2015-5330

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.

References

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

http://www.debian.org/security/2016/dsa-3433

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.securityfocus.com/bid/79734

http://www.securitytracker.com/id/1034493

http://www.ubuntu.com/usn/USN-2855-1

http://www.ubuntu.com/usn/USN-2855-2

http://www.ubuntu.com/usn/USN-2856-1

https://bugzilla.redhat.com/show_bug.cgi?id=1281326

https://git.samba.org/?p=samba.git;a=commit;h=0454b95657846fcecf0f51b6f1194faac02518bd

https://git.samba.org/?p=samba.git;a=commit;h=538d305de91e34a2938f5f219f18bf0e1918763f

https://git.samba.org/?p=samba.git;a=commit;h=7f51ec8c4ed9ba1f53d722e44fb6fb3cde933b72

https://git.samba.org/?p=samba.git;a=commit;h=a118d4220ed85749c07fb43c1229d9e2fecbea6b

https://git.samba.org/?p=samba.git;a=commit;h=ba5dbda6d0174a59d221c45cca52ecd232820d48

https://git.samba.org/?p=samba.git;a=commit;h=f36cb71c330a52106e36028b3029d952257baf15

https://security.gentoo.org/glsa/201612-47

https://www.samba.org/samba/security/CVE-2015-5330.html

Details

Source: MITRE

Published: 2015-12-29

Updated: 2016-12-31

Type: CWE-200

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.16:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.17:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.18:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.19:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.20:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.21:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.22:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.23:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.24:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.16:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.17:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.18:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.19:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.20:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.21:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.3.2:*:*:*:*:*:*:*

Tenable Plugins

View all (36 total)

IDNameProductFamilySeverity
96127GLSA-201612-47 : Samba: Multiple vulnerabilities (Badlock)NessusGentoo Local Security Checks
high
9346Samba 4.x < 4.1.22 Multiple VulnerabilitiesNessus Network MonitorSamba
medium
90609openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)NessusSuSE Local Security Checks
high
90558openSUSE Security Update : samba (openSUSE-2016-462) (Badlock)NessusSuSE Local Security Checks
high
90077RHEL 6 : Storage Server (RHSA-2016:0015)NessusRed Hat Local Security Checks
high
89383Fedora 23 : libldb-1.1.24-1.fc23 / libtalloc-2.1.5-2.fc23 / libtdb-1.3.8-1.fc23 / etc (2015-b960ca78bf)NessusFedora Local Security Checks
high
89370Fedora 22 : libldb-1.1.24-1.fc22 / libtalloc-2.1.5-2.fc22 / libtdb-1.3.8-1.fc22 / etc (2015-af140eefbc)NessusFedora Local Security Checks
high
88804Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : samba regression (USN-2855-2)NessusUbuntu Local Security Checks
high
88005SUSE SLED11 / SLES11 Security Update : samba (SUSE-SU-2016:0164-1)NessusSuSE Local Security Checks
high
87968Amazon Linux AMI : samba (ALAS-2016-634)NessusAmazon Linux Local Security Checks
high
87967Amazon Linux AMI : libldb (ALAS-2016-633)NessusAmazon Linux Local Security Checks
high
87863SUSE SLES11 Security Update : samba (SUSE-SU-2016:0032-1)NessusSuSE Local Security Checks
high
87856RHEL 7 : Storage Server (RHSA-2016:0016)NessusRed Hat Local Security Checks
high
87855RHEL 6 / 7 : Storage Server (RHSA-2016:0014)NessusRed Hat Local Security Checks
high
87844Scientific Linux Security Update : samba on SL7.x x86_64 (20160107)NessusScientific Linux Local Security Checks
high
87842Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20160107)NessusScientific Linux Local Security Checks
high
87839Scientific Linux Security Update : libldb on SL6.x, SL7.x i386/x86_64 (20160107)NessusScientific Linux Local Security Checks
high
87810RHEL 6 : samba4 (RHSA-2016:0010)NessusRed Hat Local Security Checks
high
87809RHEL 6 / 7 : libldb (RHSA-2016:0009)NessusRed Hat Local Security Checks
high
87806RHEL 7 : samba (RHSA-2016:0006)NessusRed Hat Local Security Checks
high
87797Oracle Linux 6 : samba4 (ELSA-2016-0010)NessusOracle Linux Local Security Checks
high
87796Oracle Linux 6 / 7 : libldb (ELSA-2016-0009)NessusOracle Linux Local Security Checks
high
87793Oracle Linux 7 : samba (ELSA-2016-0006)NessusOracle Linux Local Security Checks
high
87783CentOS 6 : samba4 (CESA-2016:0010)NessusCentOS Local Security Checks
high
87782CentOS 6 / 7 : libldb (CESA-2016:0009)NessusCentOS Local Security Checks
high
87779CentOS 7 : samba (CESA-2016:0006)NessusCentOS Local Security Checks
high
87769Samba 4.2.x < 4.2.7 / 4.3.x < 4.3.3 Multiple VulnerabilitiesNessusMisc.
high
87768Samba 4.x < 4.1.22 Multiple VulnerabilitiesNessusMisc.
high
87756Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : ldb vulnerabilities (USN-2856-1)NessusUbuntu Local Security Checks
high
87755Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : samba vulnerabilities (USN-2855-1)NessusUbuntu Local Security Checks
high
87684Debian DSA-3433-1 : samba - security updateNessusDebian Local Security Checks
high
87622openSUSE Security Update : samba / ldb / talloc / etc (openSUSE-2015-945)NessusSuSE Local Security Checks
high
87621openSUSE Security Update : ldb / samba / talloc / etc (openSUSE-2015-943)NessusSuSE Local Security Checks
high
87527SUSE SLED12 / SLES12 Security Update : ldb, samba, talloc, tdb, tevent (SUSE-SU-2015:2305-1)NessusSuSE Local Security Checks
high
87526SUSE SLED12 / SLES12 Security Update : ldb, samba, talloc, tdb, tevent (SUSE-SU-2015:2304-1)NessusSuSE Local Security Checks
high
87514FreeBSD : samba -- multiple vulnerabilities (ef434839-a6a4-11e5-8275-000c292e4fd8)NessusFreeBSD Local Security Checks
high