Detections
Analytics

Echo: samba: security update to 2:4.17.12+dfsg-0+deb12u1

medium Tenable Self-Hosted Container Security Plugin ID 463127

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test
 Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked
 indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC
 task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service
 disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function
 under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls
 to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most
 services and leading to a complete denial of service on the AD DC. The DoS affects all other services as
 "rpcecho" runs in the main RPC task. (CVE-2023-42669)

Solution

Update the samba library and its related packages to version 2:4.17.12+dfsg-0+deb12u1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2023-42669

Plugin Details

Severity: Medium

ID: 463127

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2023-42669

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/2/2026

Vulnerability Publication Date: 10/10/2023

Reference Information

CVE: CVE-2023-42669

IAVA: 2023-A-0535-S