CVE-2014-0239

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/59579Third Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xmlThird Party Advisory
http://www.samba.org/samba/security/CVE-2014-0239Vendor Advisory
http://www.securityfocus.com/bid/67691Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030309Third Party Advisory, VDB Entry
http://secunia.com/advisories/59579Third Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xmlThird Party Advisory
http://www.samba.org/samba/security/CVE-2014-0239Vendor Advisory
http://www.securityfocus.com/bid/67691Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030309Third Party Advisory, VDB Entry

Timeline

Published: May 28, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-02406.2The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on CVE-2014-02415.5rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable CVE-2014-02427.5mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Cont CVE-2014-02435.5Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job.CVE-2014-02443.3The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause CVE-2014-02455.9It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endp CVE-2014-02464.3SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by rea CVE-2014-024710.0LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/do CVE-2014-02486.8org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and J CVE-2014-02493.3The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membershi CVE-2014-02507.5Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and hei CVE-2014-02519.0Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 20