Is CVE-2019-14907 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 3%.

What products does CVE-2019-14907 affect?

Tracked products affected include Samba. Check the version you run to see whether it is affected.

How do I fix CVE-2019-14907?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2019-14907

Q: What is CVE-2019-14907?

CVE-2019-14907 is a medium-severity software vulnerability (Out-of-bounds read) with a CVSS score of 6.5. All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printe

MEDIUM severity · CVSS 6.5 · Out-of-bounds read

6.5CVSS MEDIUM

Summary

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)3%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products we track (1)

Samba

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2019-14907

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information