Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability

August 25th, 2023
ZDI-23-1227 ZDI-CAN-20229

CVE ID

CVE-2023-34967

CVSS Score

5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Vendors

Samba

Affected Products

Samba

Vulnerability Details

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Samba. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of Spotlight RPC arguments. Crafted arguments can force the server into an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the service.

Additional Details

Samba has issued an update to correct this vulnerability. More details can be found at:
https://www.samba.org/samba/security/CVE-2023-34967.html

Disclosure Timeline

  • 2023-03-22 - Vulnerability reported to vendor
  • 2023-08-25 - Coordinated public release of advisory

Credit

Florent Saudel (@thalium_team)

Back to Advisories