CVE-2023-42669

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Nov 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-426706.5A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptiCVE-2023-426715.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426725.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426735.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426745.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426755.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426765.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426775.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426785.5In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to locCVE-2023-426794.4In gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with SystemCVE-2023-426804.4In gpu driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System CVE-2023-426817.8In ion service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution
CVE-2023-42669: Medium severity, CVSS 6.5 | Vulnix