Is CVE-2020-10704 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 3%.

What products does CVE-2020-10704 affect?

Tracked products affected include Fedora. Check the version you run to see whether it is affected.

How do I fix CVE-2020-10704?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2020-10704

Q: What is CVE-2020-10704?

CVE-2020-10704 is a high-severity software vulnerability (CWE-674) with a CVSS score of 7.5. A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a den

HIGH severity · CVSS 7.5 · CWE-674

7.5CVSS HIGH

Summary

A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)3%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products we track (1)

Fedora

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://www.samba.org/samba/security/CVE-2020-10704.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.htmlAdvisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10704Advisory
https://lists.debian.org/debian-lts-announce/2020/11/msg00041.htmlAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5KW3ZO35NVDO57JSBZHTQZOS3AIQ5QE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7DVGCHG3XPIBQ5ETGMGW7MXNOO4HFH4/
https://security.gentoo.org/glsa/202007-15Advisory