CVE-2020-14303
📋 TL;DR
This vulnerability allows any user to crash Samba's AD DC NBT server by sending an empty UDP packet, causing denial of service. It affects all Samba versions before 4.10.17, 4.11.11, and 4.12.4. Organizations running vulnerable Samba servers as Active Directory Domain Controllers are impacted.
💻 Affected Systems
- Samba
📦 What is this software?
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Samba by Samba
Samba by Samba
Samba by Samba
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of Samba AD DC services, disrupting authentication, file sharing, and domain services for all dependent systems.
Likely Case
Service disruption requiring manual restart of Samba services, causing temporary authentication and file sharing outages.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and service restoration.
🎯 Exploit Status
Exploitation requires only the ability to send UDP packets to port 137 (NetBIOS Name Service). No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Samba 4.10.17, 4.11.11, or 4.12.4 and later
Vendor Advisory: https://www.samba.org/samba/security/CVE-2020-14303.html
Restart Required: Yes
Instructions:
1. Update Samba packages using your distribution's package manager. 2. For Red Hat/CentOS: 'yum update samba'. 3. For Debian/Ubuntu: 'apt update && apt upgrade samba'. 4. Restart Samba services: 'systemctl restart smb nmb winbind'.
🔧 Temporary Workarounds
Block UDP port 137
linuxPrevent external access to the vulnerable NetBIOS Name Service port
iptables -A INPUT -p udp --dport 137 -j DROP
firewall-cmd --permanent --add-rich-rule='rule protocol value="udp" port port="137" reject'
ufw deny 137/udp
Disable NBT server if not needed
linuxTurn off NetBIOS over TCP/IP if not required for your environment
Edit /etc/samba/smb.conf and add: 'disable netbios = yes'
Then restart Samba: 'systemctl restart smb nmb'
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to Samba servers
- Deploy network monitoring to detect and alert on suspicious UDP traffic to port 137
🔍 How to Verify
Check if Vulnerable:
Check Samba version: 'smbd --version' or 'rpm -q samba' or 'dpkg -l | grep samba'. If version is below 4.10.17, 4.11.11, or 4.12.4 and AD DC is enabled, system is vulnerable.Check Version:
smbd --version | head -1Verify Fix Applied:
Confirm version is 4.10.17+, 4.11.11+, or 4.12.4+ and test by attempting to send empty UDP packet to port 137 (should not crash).📡 Detection & Monitoring
Log Indicators:
- Samba service crashes in system logs
- Unexpected Samba process termination
- High volume of UDP packets to port 137 in firewall logs
Network Indicators:
- Empty UDP packets to port 137
- Sudden drop in Samba service availability
SIEM Query:
source="samba.log" AND ("segmentation fault" OR "crash" OR "terminated") OR destination_port=137 AND protocol=udp AND packet_size=0🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1851298%3B
- https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YLNQ5GRXUKYRUAOFZ4DUBVN4SMTL6Q2/
- https://security.gentoo.org/glsa/202007-15
- https://security.netapp.com/advisory/ntap-20200709-0003/
- https://usn.ubuntu.com/4454-1/
- https://usn.ubuntu.com/4454-2/
- https://www.samba.org/samba/security/CVE-2020-14303.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1851298%3B
- https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YLNQ5GRXUKYRUAOFZ4DUBVN4SMTL6Q2/
- https://security.gentoo.org/glsa/202007-15
- https://security.netapp.com/advisory/ntap-20200709-0003/
- https://usn.ubuntu.com/4454-1/
- https://usn.ubuntu.com/4454-2/
- https://www.samba.org/samba/security/CVE-2020-14303.html
