CVE-2023-42669
Summary
| CVE | CVE-2023-42669 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-11-06 07:15:00 UTC |
| Updated | 2023-11-14 18:20:00 UTC |
| Description | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Eus | 9.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux For Ibm Z Systems | 9.0_s390x | All | All | All |
| Operating System | Redhat | Enterprise Linux For Ibm Z Systems Eus | 9.0_s390x | All | All | All |
| Operating System | Redhat | Enterprise Linux For Power Little Endian | 9.0_ppc64le | All | All | All |
| Operating System | Redhat | Enterprise Linux For Power Little Endian Eus | 9.0_ppc64le | All | All | All |
| Application | Redhat | Storage | 3.0 | All | All | All |
| Application | Samba | Samba | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cve-details | MISC | access.redhat.com | |
| 2241884 – (CVE-2023-42669) CVE-2023-42669 samba: "rpcecho" development server allows denial of service via sleep() call on AD DC | MISC | bugzilla.redhat.com | |
| Red Hat | MISC | access.redhat.com | |
| Red Hat | access.redhat.com | ||
| Samba - Security Announcement Archive | MISC | www.samba.org | |
| 15474 – (CVE-2023-42669) [SECURITY] CVE-2023-42669 rpcecho, enabled and running in AD DC, allows blocking sleep on request | MISC | bugzilla.samba.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161070 Oracle Enterprise Linux Security Update for samba (ELSA-2023-6744)
- 161196 Oracle Enterprise Linux Security Update for samba (ELSA-2023-7467)
- 199820 Ubuntu Security Notification for Samba Vulnerabilities (USN-6425-1)
- 199907 Ubuntu Security Notification for Samba Vulnerabilities (USN-6425-3)
- 242260 Red Hat Update for samba (RHSA-2023:6209)
- 242318 Red Hat Update for samba (RHSA-2023:6744)
- 242484 Red Hat Update for samba (RHSA-2023:7408)
- 242507 Red Hat Update for samba (RHSA-2023:7467)
- 242508 Red Hat Update for samba (RHSA-2023:7464)
- 242602 Red Hat Update for samba (RHSA-2023:7371)
- 284612 Fedora Security Update for samba (FEDORA-2023-7eb8cbf1a5)
- 284682 Fedora Security Update for samba (FEDORA-2023-fff0c857d6)
- 285191 Fedora Security Update for samba (FEDORA-2023-8c9251e479)
- 503395 Alpine Linux Security Update for samba
- 505937 Alpine Linux Security Update for samba
- 6000310 Debian Security Update for samba (DSA 5525-1)
- 673574 EulerOS Security Update for samba (EulerOS-SA-2023-3286)
- 673680 EulerOS Security Update for samba (EulerOS-SA-2023-3258)
- 710873 Gentoo Linux Samba Multiple Vulnerabilities (GLSA 202402-28)
- 755069 SUSE Enterprise Linux Security Update for samba (SUSE-SU-2023:4046-1)
- 755081 SUSE Enterprise Linux Security Update for samba (SUSE-SU-2023:4059-1)
- 755106 SUSE Enterprise Linux Security Update for samba (SUSE-SU-2023:4096-1)
- 941395 AlmaLinux Security Update for samba (ALSA-2023:6744)
- 941422 AlmaLinux Security Update for samba (ALSA-2023:7467)