Published: 10/10/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Libntlm up to and including 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nongnu libntlm
debian debian linux 8.0
debian debian linux 9.0
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 14.04
canonical ubuntu linux 20.04
fedoraproject fedora 32
fedoraproject fedora 33
opensuse leap 15.1
opensuse backports sle 15.0

Debian Bug report logs - #942145 libntlm: CVE-2019-17455 Package: src:libntlm; Maintainer for src:libntlm is Debian Authentication Maintainers <pkg-auth-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 10 Oct 2019 20:33:01 UTC Severity: important Tags: security, u ...

Mirror of Simon Josefsson's Libntlm

Libntlm README -- Introduction information Libntlm is a client-side Microsoft NTLM authentication library References for the NTLM protocol are: The NTLM Authentication Protocol, by Eric Glass NTLM Authentication Scheme for HTTP, by Ronald Tschalär Warning! NTLM is not a secure authentication protocol -- it uses MD4 and single-DES MD4 has been broken, and single-DES

CWE-125 https://gitlab.com/jas/libntlm/issues/2 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145 https://security-tracker.debian.org/tracker/CVE-2019-17455 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.html https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145 https://nvd.nist.gov https://github.com/jas4711/libntlm

CVE-2019-17455

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect