CVE-2019-17455
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-17455
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-17455.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-17455
- Related
- Published
- 2019-10-10T18:15:11Z
- Modified
- 2025-03-03T07:50:51.156779Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.
- References
-
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145
- https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html
- https://gitlab.com/jas/libntlm/issues/2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.html
- https://security-tracker.debian.org/tracker/CVE-2019-17455
Affected packages
Debian:11 / libntlm
Package
- Name
- libntlm
- Purl
- pkg:deb/debian/libntlm?arch=source
Debian:12 / libntlm
Package
- Name
- libntlm
- Purl
- pkg:deb/debian/libntlm?arch=source
Debian:13 / libntlm
Package
- Name
- libntlm
- Purl
- pkg:deb/debian/libntlm?arch=source
Git / gitlab.com/jas/libntlm
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.com/jas/libntlm
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Type
- GIT
- Repo
- https://gitlab.labs.nic.cz/labs/bird
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affecteddeec752ef941eef4c36c21c5c5426d08e98c7a44
Affected versions
Other
libntlm-0-0
libntlm-0-1
libntlm-0-2
libntlm-0-21
libntlm-0-3-0
libntlm-0-3-1
libntlm-0-3-10
libntlm-0-3-11
libntlm-0-3-12
libntlm-0-3-13
libntlm-0-3-2
libntlm-0-3-3
libntlm-0-3-4
libntlm-0-3-5
libntlm-0-3-6
libntlm-0-3-7
libntlm-0-3-8
libntlm-0-3-9
libntlm-0-4-0
libntlm-0-4-1
libntlm-0-4-2
libntlm-1-0
libntlm-1-1
libntlm-1-2
libntlm-1-3
libntlm-1-4
libntlm-1-5
v1.*
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1
v1.3.10
v1.3.11
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0