CVE - CVE-2023-42669

CVE-ID
CVE-2023-42669	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:RHBZ#2241884 URL:https://bugzilla.redhat.com/show_bug.cgi?id=2241884 MISC:RHSA-2023:6209 URL:https://access.redhat.com/errata/RHSA-2023:6209 MISC:RHSA-2023:6744 URL:https://access.redhat.com/errata/RHSA-2023:6744 MISC:RHSA-2023:7371 URL:https://access.redhat.com/errata/RHSA-2023:7371 MISC:RHSA-2023:7408 URL:https://access.redhat.com/errata/RHSA-2023:7408 MISC:RHSA-2023:7464 URL:https://access.redhat.com/errata/RHSA-2023:7464 MISC:RHSA-2023:7467 URL:https://access.redhat.com/errata/RHSA-2023:7467 MISC:https://access.redhat.com/security/cve/CVE-2023-42669 URL:https://access.redhat.com/security/cve/CVE-2023-42669 MISC:https://bugzilla.samba.org/show_bug.cgi?id=15474 URL:https://bugzilla.samba.org/show_bug.cgi?id=15474 MISC:https://www.samba.org/samba/security/CVE-2023-42669.html URL:https://www.samba.org/samba/security/CVE-2023-42669.html
Assigning CNA
Red Hat, Inc.
Date Record Created
20230913	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230913)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)