Skip to content
OpenAdvisories
Unscored USN-2257-1 4 CVEs

samba vulnerabilities

Published Jun 26, 2014 · Updated Apr 22, 2026

Summary

Christof Schmitt discovered that Samba incorrectly initialized a certain
response field when vfs shadow copy was enabled. A remote authenticated
attacker could use this issue to possibly obtain sensitive information.
This issue only affected Ubuntu 13.10 and Ubuntu 14.04 LTS. (CVE-2014-0178)

It was discovered that the Samba internal DNS server incorrectly handled QR
fields when processing incoming DNS messages. A remote attacker could use
this issue to cause Samba to consume resources, resulting in a denial of
service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0239)

Daniel Berteaud discovered that the Samba NetBIOS name service daemon
incorrectly handled certain malformed packets. A remote attacker could use
this issue to cause Samba to consume resources, resulting in a denial of
service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and
Ubuntu 14.04 LTS. (CVE-2014-0244)

Simon Arlott discovered that Samba incorrectly handled certain unicode path
names. A remote authenticated attacker could use this issue to cause Samba
to stop responding, resulting in a denial of service. (CVE-2014-3493)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS samba 2:4.1.6+dfsg-1ubuntu2.14.04.2

Vulnerabilities 4

  • Unscored —

    Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration i…

  • Unscored —
    CVE-2014-0239 EPSS 67%

    The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS…

  • Unscored —
    CVE-2014-0244 EPSS 20%

    The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remo…

  • Unscored —

    The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote…

References

  • report
    https://ubuntu.com/security/CVE-2014-0178
  • report
    https://ubuntu.com/security/CVE-2014-0239
  • report
    https://ubuntu.com/security/CVE-2014-0244
  • report
    https://ubuntu.com/security/CVE-2014-3493