CVE-2021-20277
📋 TL;DR
This vulnerability in Samba's libldb allows an attacker to crash the LDAP server process by sending LDAP requests with multiple consecutive leading spaces in attributes. This is an out-of-bounds write vulnerability that primarily affects system availability. Any system running vulnerable versions of Samba with LDAP server functionality is affected.
💻 Affected Systems
- Samba
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Samba by Samba
Samba by Samba
Samba by Samba
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for LDAP services, potentially affecting authentication, directory lookups, and other services dependent on LDAP.
Likely Case
LDAP server process crashes, requiring service restart and causing temporary service disruption.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and block malicious LDAP requests.
🎯 Exploit Status
Exploitation requires ability to send LDAP requests to the vulnerable server, which typically requires authentication or network access to LDAP ports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Samba 4.13.17, 4.14.12, 4.15.5 or later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1941402
Restart Required: Yes
Instructions:
1. Update Samba packages using your distribution's package manager. 2. For Red Hat/Fedora: 'sudo dnf update samba'. 3. For Debian/Ubuntu: 'sudo apt update && sudo apt upgrade samba'. 4. Restart Samba services: 'sudo systemctl restart smbd nmbd' (adjust for your specific Samba services).
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to LDAP ports (389, 636) to trusted networks only
sudo iptables -A INPUT -p tcp --dport 389 -s TRUSTED_NETWORK -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 389 -j DROP
LDAP Request Filtering
allUse network filtering or WAF to block LDAP requests with excessive leading spaces
🧯 If You Can't Patch
- Implement strict network segmentation to limit LDAP access to essential systems only
- Deploy monitoring and alerting for LDAP server crashes or abnormal restart patterns
🔍 How to Verify
Check if Vulnerable:
Check Samba version: 'smbd --version' or 'rpm -q samba' or 'dpkg -l | grep samba'Check Version:
smbd --version | head -1Verify Fix Applied:
Verify version is 4.13.17+, 4.14.12+, or 4.15.5+ and test LDAP functionality📡 Detection & Monitoring
Log Indicators:
- LDAP server process crashes in system logs
- Multiple Samba/LDAP service restarts
- LDAP error logs showing malformed requests
Network Indicators:
- LDAP requests with unusual spacing patterns
- Multiple connection attempts to LDAP ports
SIEM Query:
source="samba.log" AND ("crash" OR "segfault" OR "out-of-bounds") OR source="auth.log" AND "ldap" AND ("failed" OR "error")🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1941402
- https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5J3B6PN5XMXF3OHYBNHDKZ3XFSUGY4L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXP3ONIY6MB4C5LDZV4YL5KJCES3UX24/
- https://security.gentoo.org/glsa/202105-22
- https://security.netapp.com/advisory/ntap-20210326-0007/
- https://www.debian.org/security/2021/dsa-4884
- https://www.samba.org/samba/security/CVE-2021-20277.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1941402
- https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5J3B6PN5XMXF3OHYBNHDKZ3XFSUGY4L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXP3ONIY6MB4C5LDZV4YL5KJCES3UX24/
- https://security.gentoo.org/glsa/202105-22
- https://security.netapp.com/advisory/ntap-20210326-0007/
- https://www.debian.org/security/2021/dsa-4884
- https://www.samba.org/samba/security/CVE-2021-20277.html
