CVE-2020-27840
📋 TL;DR
This vulnerability in Samba allows attackers to cause a denial-of-service by sending specially crafted domain name strings with spaces. When Samba processes these malformed DN strings, it writes a zero-byte into out-of-bounds memory, leading to a crash. Any system running vulnerable versions of Samba is affected.
💻 Affected Systems
- Samba
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Samba by Samba
Samba by Samba
Samba by Samba
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Samba services, potentially affecting file sharing, authentication, and domain services across the network.
Likely Case
Service crashes requiring manual restart, disrupting file sharing and authentication services temporarily.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and block exploitation attempts.
🎯 Exploit Status
Exploitation requires sending specially crafted DN strings to Samba services. No authentication is needed, making it accessible to any network-accessible attacker.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Samba 4.13.0 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1941400
Restart Required: Yes
Instructions:
1. Update Samba to version 4.13.0 or later using your distribution's package manager. 2. For Red Hat/Fedora: 'sudo dnf update samba'. 3. For Debian/Ubuntu: 'sudo apt update && sudo apt upgrade samba'. 4. Restart Samba services: 'sudo systemctl restart smbd nmbd' (adjust for your distribution).
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to Samba services to trusted IP addresses only.
sudo ufw allow from 192.168.1.0/24 to any port 139,445
sudo ufw allow from 192.168.1.0/24 to any port 389
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Samba servers from untrusted networks.
- Monitor Samba logs for crash events and implement automated alerting for service restarts.
🔍 How to Verify
Check if Vulnerable:
Check Samba version: 'smbd --version' or 'samba --version'. If version is below 4.13.0, the system is vulnerable.Check Version:
smbd --versionVerify Fix Applied:
After patching, verify version is 4.13.0 or higher: 'smbd --version'. Test Samba services are running: 'systemctl status smbd nmbd'.📡 Detection & Monitoring
Log Indicators:
- Samba service crashes in system logs
- Segmentation fault errors in Samba logs
- Unexpected service restarts
Network Indicators:
- Unusual LDAP queries with spaces in DN strings
- Multiple connection attempts to Samba ports followed by service disruption
SIEM Query:
source="samba.log" AND ("segmentation fault" OR "crash" OR "out-of-bounds")🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1941400
- https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5J3B6PN5XMXF3OHYBNHDKZ3XFSUGY4L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXP3ONIY6MB4C5LDZV4YL5KJCES3UX24/
- https://security.gentoo.org/glsa/202105-22
- https://security.netapp.com/advisory/ntap-20210326-0007/
- https://www.debian.org/security/2021/dsa-4884
- https://www.samba.org/samba/security/CVE-2020-27840.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1941400
- https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5J3B6PN5XMXF3OHYBNHDKZ3XFSUGY4L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXP3ONIY6MB4C5LDZV4YL5KJCES3UX24/
- https://security.gentoo.org/glsa/202105-22
- https://security.netapp.com/advisory/ntap-20210326-0007/
- https://www.debian.org/security/2021/dsa-4884
- https://www.samba.org/samba/security/CVE-2020-27840.html
