Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5108-2 advisory.

  - Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and     tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in     buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request. (CVE-2019-17455)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2831 advisory.

  - Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and     tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in     buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request. (CVE-2019-17455)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5108-1 advisory.

  - Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and     tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in     buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request. (CVE-2019-17455)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libntlm fixes the following issues :

Update to release 1.6 :

  - CVE-2019-17455: Fixed a buffer overflow in     buildSmbNtlmAuth* function. (boo#1153669)

It was discovered that libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

For Debian 8 'Jessie', this problem has been fixed in version 1.4-3+deb8u1.

We recommend that you upgrade your libntlm packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NVD reports :

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

ID	Name	Product	Family	Severity
183529	Ubuntu 16.04 ESM : Libntlm vulnerability (USN-5108-2)	Nessus	Ubuntu Local Security Checks	critical
155713	Debian DLA-2831-1 : libntlm - LTS security update	Nessus	Debian Local Security Checks	critical
153959	Ubuntu 18.04 LTS / 20.04 LTS : libntlm vulnerability (USN-5108-1)	Nessus	Ubuntu Local Security Checks	critical
138684	openSUSE Security Update : libntlm (openSUSE-2020-806)	Nessus	SuSE Local Security Checks	critical
136429	Debian DLA-2207-1 : libntlm security update	Nessus	Debian Local Security Checks	critical
135881	FreeBSD : libntlm -- buffer overflow vulnerability (0f798bd6-8325-11ea-9a78-08002728f74c)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-17455

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical