CVE-2019-17455
- Source
- https://cve.org/CVERecord?id=CVE-2019-17455
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-17455.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-17455
- Downstream
- Related
- Published
- 2019-10-10T18:15:11.647Z
- Modified
- 2026-01-31T01:11:46.040183Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.
- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145
- https://gitlab.com/jas/libntlm/issues/2
- https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.html
- https://security-tracker.debian.org/tracker/CVE-2019-17455
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145
- https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145
- https://gitlab.com/jas/libntlm/issues/2
Affected packages
Git / gitlab.com/jas/libntlm
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.com/jas/libntlm
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
Affected versions
Other
libntlm-0-0
libntlm-0-1
libntlm-0-2
libntlm-0-21
libntlm-0-3-0
libntlm-0-3-1
libntlm-0-3-10
libntlm-0-3-11
libntlm-0-3-12
libntlm-0-3-13
libntlm-0-3-2
libntlm-0-3-3
libntlm-0-3-4
libntlm-0-3-5
libntlm-0-3-6
libntlm-0-3-7
libntlm-0-3-8
libntlm-0-3-9
libntlm-0-4-0
libntlm-0-4-1
libntlm-0-4-2
libntlm-1-0
libntlm-1-1
libntlm-1-2
libntlm-1-3
libntlm-1-4
libntlm-1-5