CVE-2015-5330

Name of the Vulnerable Software and Affected Versions Samba versions 4.1.x through 4.1.21 Samba versions 4.2.x through 4.2.6 Samba versions 4.3.x through 4.3.2 ldb versions prior to 1.1.24

Description The issue is related to the mishandling of string lengths in the ldb library, used in the AD LDAP server in Samba. This allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading an error message or a database value. The vulnerability is associated with information disclosure.

Recommendations For Samba versions 4.1.x through 4.1.21, update to version 4.1.22 or later. For Samba versions 4.2.x through 4.2.6, update to version 4.2.7 or later. For Samba versions 4.3.x through 4.3.2, update to version 4.3.3 or later. For ldb versions prior to 1.1.24, update to version 1.1.24 or later.