NetSight
IP …
critical9.8

CVE-2019-17455

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demons…

Impact

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

Affected products

VendorProductAffected versions
NongnuLibntlm
through 1.5
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 20.04
FedoraprojectFedora
Versions 32, 33
OpensuseBackports Sle
Version 15.0
OpensuseLeap
Version 15.1

Weakness classification

CWE-125

References