CVE-2015-3223

Description

The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service (infinite loop) via crafted packets.

References

https://www.samba.org/samba/security/CVE-2015-3223.html

https://security.gentoo.org/glsa/201612-47

https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=ec504dbf69636a554add1f3d5703dd6c3ad450b8

https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=aa6c27148b9d3f8c1e4fdd5dd46bfecbbd0ca465

https://bugzilla.redhat.com/show_bug.cgi?id=1290287

http://www.ubuntu.com/usn/USN-2856-1

http://www.ubuntu.com/usn/USN-2855-2

http://www.ubuntu.com/usn/USN-2855-1

http://www.securitytracker.com/id/1034493

http://www.securityfocus.com/bid/79731

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.debian.org/security/2016/dsa-3433

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3