CVE catalog

CVE-2023-42670

samba: CVE-2023-42670

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Oct 10, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.32% · Oct 25, 2026

A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	samba	sid	`2:4.25.1+dfsg-1`	fixed
Debian	samba	forky	`2:4.25.1+dfsg-1`	fixed
Debian	samba	trixie	`2:4.22.11+dfsg-0+deb13u1`	fixed
Debian	samba	trixie-security	`2:4.22.10+dfsg-0+deb13u2`	fixed
Debian	samba	bookworm	`2:4.17.12+dfsg-0+deb12u4`	fixed
Debian	samba	bookworm-security	`2:4.17.12+dfsg-0+deb12u4`	fixed
Alpine	samba	3.18	`4.18.8-r0`	fixed
Alpine	samba	3.19	`4.18.8-r0`	fixed
Alpine	samba	3.20	`4.18.8-r0`	fixed
Alpine	samba	3.21	`4.18.8-r0`	fixed
Alpine	samba	3.22	`4.18.8-r0`	fixed
Alpine	samba	3.23	`4.18.8-r0`	fixed
Alpine	samba	3.24	`4.18.8-r0`	fixed
Ubuntu	samba	22.04	`2:4.13.5+dfsg-2ubuntu2`	vulnerable
Ubuntu	samba	22.04	`2:4.13.5+dfsg-2ubuntu3`	vulnerable
Ubuntu	samba	22.04	`2:4.13.14+dfsg-0ubuntu1`	vulnerable
Ubuntu	samba	22.04	`2:4.13.14+dfsg-0ubuntu2`	vulnerable
Ubuntu	samba	22.04	`2:4.15.5~dfsg-0ubuntu1`	vulnerable
Ubuntu	samba	22.04	`2:4.15.5~dfsg-0ubuntu2`	vulnerable
Ubuntu	samba	22.04	`2:4.15.5~dfsg-0ubuntu4`	vulnerable
Ubuntu	samba	22.04	`2:4.15.5~dfsg-0ubuntu5`	vulnerable
Ubuntu	samba	22.04	`2:4.15.5~dfsg-0ubuntu5.1`	vulnerable
Ubuntu	samba	22.04	`2:4.15.9+dfsg-0ubuntu0.2`	vulnerable
Ubuntu	samba	22.04	`2:4.15.9+dfsg-0ubuntu0.3`	vulnerable
Ubuntu	samba	22.04	`2:4.15.13+dfsg-0ubuntu1`	vulnerable
Ubuntu	samba	22.04	`2:4.15.13+dfsg-0ubuntu1.1`	vulnerable
Ubuntu	samba	22.04	`2:4.15.13+dfsg-0ubuntu1.2`	vulnerable
Ubuntu	samba	22.04	`2:4.15.13+dfsg-0ubuntu1.3`	vulnerable
Ubuntu	samba	22.04	`2:4.15.13+dfsg-0ubuntu1.4`	vulnerable
Ubuntu	samba	22.04	`2:4.15.13+dfsg-0ubuntu1.5`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	samba	source	sid	`2:4.19.1+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	samba	source	forky	`2:4.19.1+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	samba	source	trixie	`2:4.19.1+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	samba	source	bookworm	`2:4.17.12+dfsg-0+deb12u1`	not yet assigned	Not reported	Not reported
Alpine	samba	apk	3.18	`4.18.8-r0`	Not reported	ALPINE-CVE-2023-42670	Not reported
Alpine	samba	apk	3.19	`4.18.8-r0`	Not reported	ALPINE-CVE-2023-42670	Not reported
Alpine	samba	apk	3.20	`4.18.8-r0`	Not reported	ALPINE-CVE-2023-42670	Not reported
Alpine	samba	apk	3.21	`4.18.8-r0`	Not reported	ALPINE-CVE-2023-42670	Not reported
Alpine	samba	apk	3.22	`4.18.8-r0`	Not reported	ALPINE-CVE-2023-42670	Not reported
Alpine	samba	apk	3.23	`4.18.8-r0`	Not reported	ALPINE-CVE-2023-42670	Not reported
Alpine	samba	apk	3.24	`4.18.8-r0`	Not reported	ALPINE-CVE-2023-42670	Not reported
Ubuntu	samba	deb	22.04	`2:4.15.13+dfsg-0ubuntu1.5`	Not reported	UBUNTU-CVE-2023-42670	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]