CVE-2019-14833

Publication date 29 October 2019

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
samba	19.10 eoan	Fixed 2:4.10.7+dfsg-0ubuntu2.2
	19.04 disco	Fixed 2:4.10.0+dfsg-0ubuntu2.6
	18.04 LTS bionic	Fixed 2:4.7.6+dfsg~ubuntu-0ubuntu2.13
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

mdeslaur

4.5+ only

Severity score breakdown

Parameter	Value
Base score	5.4 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Related Ubuntu Security Notices (USN)

USN-4167-1
Samba vulnerabilities
29 October 2019