As per samba upstream advisory: All versions of Samba from 4.0.0 to 4.3.2 inclusive are vulnerable to a denial of service attack in the samba daemon LDAP server. A malicious client can send packets that cause the LDAP server in the samba daemon process to become unresponsive, preventing the server from servicing any other requests. This flaw is not exploitable beyond causing the code to loop expending CPU resources.
Acknowledgements: Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Thilo Uttendorfer as the original reporter.
Created samba tracking bugs for this issue: Affects: fedora-all [bug 1292069]
External References: https://www.samba.org/samba/security/CVE-2015-3223.html
Upstream commits tagged with CVE-2015-3223. Both are changes in libldb rather than samba. https://git.samba.org/?p=samba.git;a=commitdiff;h=ec504dbf69636a554add1f3d5703dd6c3ad450b8 https://git.samba.org/?p=samba.git;a=commitdiff;h=aa6c27148b9d3f8c1e4fdd5dd46bfecbbd0ca465
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:0009 https://rhn.redhat.com/errata/RHSA-2016-0009.html
This issue has been addressed in the following products: Red Hat Gluster Storage 3.1 for RHEL 6 Red Hat Gluster Storage 3.1 for RHEL 7 Via RHSA-2016:0014 https://rhn.redhat.com/errata/RHSA-2016-0014.html