Red Hat Bugzilla – Bug 1309978
CVE-2016-0771 samba: Out-of-bounds read in internal DNS server
Last modified: 2016-03-15 07:33:02 EDT
As per upstream samba advisory:
All versions of Samba from 4.0.0 to 4.4.0rc2 inclusive, when deployed as an AD DC and choose to run the internal DNS server, are vulnerable to an out-of-bounds read issue during DNS TXT record handling caused by users with permission to modify DNS records.
A malicious client can upload a specially constructed DNS TXT record, resulting in a remote denial-of-service attack. As long as the affected TXT record remains undisturbed in the Samba database, a targeted DNS query may continue to trigger this exploit.
While unlikely, the out-of-bounds read may bypass safety checks and allow leakage of memory from the server in the form of a DNS TXT reply.
Red Hat would like to thank the samba project for reporting this issue. Upstream acknowledges Garming Sam and Douglas Bagnall as the original reporters of this issue.