samba: CVE-2019-12435: Samba AD DC Denial of Service in DNS management server (dnsserver)

Debian Bug report logs - #930748
samba: CVE-2019-12435: Samba AD DC Denial of Service in DNS management server (dnsserver)

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: samba: CVE-2019-12435: Samba AD DC Denial of Service in DNS management server (dnsserver)

Date: Wed, 19 Jun 2019 21:47:18 +0200

Source: samba
Version: 2:4.9.5+dfsg-4
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for samba.

CVE-2019-12435[0]:
| Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer
| dereference, leading to Denial of Service. This is related to the AD
| DC DNS management server (dnsserver) RPC server process.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-12435
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12435
[1] https://www.samba.org/samba/security/CVE-2019-12435.html

Regards,
Salvatore

Message #10 received at 930748@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 930748@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: [Pkg-samba-maint] Bug#930748: samba: CVE-2019-12435: Samba AD DC Denial of Service in DNS management server (dnsserver)

Date: Wed, 19 Jun 2019 22:12:15 +0200

Le mer. 19 juin 2019 à 21:51, Salvatore Bonaccorso <carnil@debian.org> a écrit :
>
> Source: samba
> Version: 2:4.9.5+dfsg-4
> Severity: important
> Tags: security upstream
>
> Hi,

Hi,

> The following vulnerability was published for samba.
>
> CVE-2019-12435[0]:
> | Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer
> | dereference, leading to Denial of Service. This is related to the AD
> | DC DNS management server (dnsserver) RPC server process.
>
>
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2019-12435
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12435
> [1] https://www.samba.org/samba/security/CVE-2019-12435.html

I've just created a pre-approval unblock request to choose between
uploading 4.9.9 (including stability fixes) or 4.9.5+patch.


Regards

-- 
Mathieu Parent

Message #15 received at 930748@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Mathieu Parent <math.parent@gmail.com>

Cc: 930748@bugs.debian.org

Subject: Re: [Pkg-samba-maint] Bug#930748: samba: CVE-2019-12435: Samba AD DC Denial of Service in DNS management server (dnsserver)

Date: Wed, 19 Jun 2019 22:41:48 +0200

Hey,

On Wed, Jun 19, 2019 at 10:12:15PM +0200, Mathieu Parent wrote:
> > The following vulnerability was published for samba.
> >
> > CVE-2019-12435[0]:
> > | Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer
> > | dereference, leading to Denial of Service. This is related to the AD
> > | DC DNS management server (dnsserver) RPC server process.
> >
> >
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> >
> > For further information see:
> >
> > [0] https://security-tracker.debian.org/tracker/CVE-2019-12435
> >     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12435
> > [1] https://www.samba.org/samba/security/CVE-2019-12435.html
> 
> I've just created a pre-approval unblock request to choose between
> uploading 4.9.9 (including stability fixes) or 4.9.5+patch.

Ack! Thank you Mathieu.

Regards,
Salvatore

Message #20 received at 930748-done@bugs.debian.org (full text, mbox, reply):

From: Mathieu Parent <math.parent@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 930748-done@bugs.debian.org

Subject: Re: [Pkg-samba-maint] Bug#930748: samba: CVE-2019-12435: Samba AD DC Denial of Service in DNS management server (dnsserver)

Date: Thu, 20 Jun 2019 09:44:59 +0200

Version: 2:4.9.5+dfsg-5

Le mer. 19 juin 2019 à 22:41, Salvatore Bonaccorso <carnil@debian.org> a écrit :
>
> Hey,
>
> On Wed, Jun 19, 2019 at 10:12:15PM +0200, Mathieu Parent wrote:
> > > The following vulnerability was published for samba.
> > >
> > > CVE-2019-12435[0]:
> > > | Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer
> > > | dereference, leading to Denial of Service. This is related to the AD
> > > | DC DNS management server (dnsserver) RPC server process.
> > >
> > >
> > > If you fix the vulnerability please also make sure to include the
> > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> > >
> > > For further information see:
> > >
> > > [0] https://security-tracker.debian.org/tracker/CVE-2019-12435
> > >     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12435
> > > [1] https://www.samba.org/samba/security/CVE-2019-12435.html
> >
> > I've just created a pre-approval unblock request to choose between
> > uploading 4.9.9 (including stability fixes) or 4.9.5+patch.
>
> Ack! Thank you Mathieu.

I've uploaded 2:4.9.5+dfsg-5 with only targeted fixes.

But I forgot to add the Closes:. CLosing now.

Regards
-- 
Mathieu Parent

Send a report that this bug log contains spam.