Skip to content
Fencer Vulns
medium 6.5

CVE-2023-42669 json

Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc

published 2023-11-06 3 y ago modified 2026-11-07 2 d ago also EUVD-2023-47101

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 0:4.18.6-2.el8_9
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 0:4.15.5-13.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 0:4.17.5-4.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:4.18.6-101.el9_3
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 0:4.15.5-111.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:4.17.5-104.el9_2
  • Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 0:4.15.5-13.el8_6
  • samba Debian 12 2:4.17.12+dfsg-0+deb12u1
  • samba Debian 14, Debian 13 2:4.19.1+dfsg-1

debian advisories DEBIAN-CVE-2023-42669

  • samba Ubuntu 20.04 LTS 2:4.15.13+dfsg-0ubuntu0.20.04.6
  • samba Ubuntu 22.04 LTS 2:4.15.13+dfsg-0ubuntu1.5
  • samba Ubuntu 24.04 LTS 2:4.18.6+dfsg-1ubuntu2.1

ubuntu advisories UBUNTU-CVE-2023-42669

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • samba RHEL 8 4.18.6-2.el8_9
  • ctdb RHEL 8 4.18.6-2.el8_9
  • libnetapi RHEL 8 4.18.6-2.el8_9
  • samba-libs RHEL 8 4.18.6-2.el8_9
  • samba-pidl RHEL 8 4.18.6-2.el8_9
  • samba-test RHEL 8 4.18.6-2.el8_9
  • libwbclient RHEL 8 4.18.6-2.el8_9
  • samba-tools RHEL 8 4.18.6-2.el8_9

red hat advisories RHSA-2023:7467RHSA-2023:7464RHSA-2023:7408RHSA-2023:7371RHSA-2023:6744RHSA-2023:6209

  • samba SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +6 more 4.15.13+git.691.3d3cea0641-150300.3.63.1
  • samba SLE Module for Basesystem 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +2 more 4.15.13+git.691.3d3cea0641-150400.3.31.1
  • samba SLE Module for Basesystem 15 SP5, SLE Micro 5.5, SLE High Availability Extension 15 SP5 +1 more 4.17.9+git.421.abde31ca5c2-150500.3.11.1

suse advisories SUSE-SU-2023:4096-1SUSE-SU-2023:4059-1SUSE-SU-2023:4046-1

  • samba openSUSE Tumbleweed 4.19.1+git.312.c912b3d2ef6-1.1

opensuse advisories openSUSE-SU-2024:13332-1

  • samba AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • ctdb AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • libnetapi AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-libs AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-pidl AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-test AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • libwbclient AlmaLinux 8 4.18.6-2.el8_9.alma.1
  • samba-tools AlmaLinux 8 4.18.6-2.el8_9.alma.1

almalinux advisories ALSA-2023:7467ALSA-2023:6744

  • samba Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 4.18.8-r0

alpine advisories ALPINE-CVE-2023-42669

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-42669 updated cvss 6.5

samba: "rpcecho" development server allows denial of service via sleep() call on AD DC

  • Red Hat Enterprise Linux 6 samba, samba4, samba4-dc, samba-swat, samba4-libs, samba4-pidl, +17 more Red Hat Enterprise Linux 7 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +18 more Red Hat Storage 3 ctdb, samba, samba-dc, ctdb-tests, samba-libs, samba-pidl, +21 more
    affected: workaround, no fix planned “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~”
  • Red Hat CodeReady Linux Builder (v. 8) samba-devel 4.18.6-2.el8_9, ctdb-debuginfo 4.18.6-2.el8_9, libnetapi-devel 4.18.6-2.el8_9, samba-debuginfo 4.18.6-2.el8_9, libwbclient-devel 4.18.6-2.el8_9, samba-debugsource 4.18.6-2.el8_9, +24 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7467
  • Red Hat CodeReady Linux Builder (v. 9) samba-pidl 4.18.6-101.el9_3, samba-test 4.18.6-101.el9_3, samba-test-libs 4.18.6-101.el9_3, python3-samba-test 4.18.6-101.el9_3
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6744
  • Red Hat CodeReady Linux Builder EUS (v.8.6) samba-devel 4.15.5-13.el8_6, ctdb-debuginfo 4.15.5-13.el8_6, samba-debuginfo 4.15.5-13.el8_6, libwbclient-devel 4.15.5-13.el8_6, samba-debugsource 4.15.5-13.el8_6, libsmbclient-devel 4.15.5-13.el8_6, +17 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7408
  • Red Hat CodeReady Linux Builder EUS (v.8.8) samba-devel 4.17.5-4.el8_8, ctdb-debuginfo 4.17.5-4.el8_8, libnetapi-devel 4.17.5-4.el8_8, samba-debuginfo 4.17.5-4.el8_8, libwbclient-devel 4.17.5-4.el8_8, samba-debugsource 4.17.5-4.el8_8, +24 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7464
  • Red Hat CodeReady Linux Builder EUS (v.9.0) samba-pidl 4.15.5-111.el9_0, samba-test 4.15.5-111.el9_0, samba-test-libs 4.15.5-111.el9_0
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6209
  • Red Hat CodeReady Linux Builder EUS (v.9.2) samba-pidl 4.17.5-104.el9_2, samba-test 4.17.5-104.el9_2, samba-test-libs 4.17.5-104.el9_2, python3-samba-test 4.17.5-104.el9_2
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7371
  • Red Hat Enterprise Linux AppStream (v. 8) samba-vfs-iouring 4.18.6-2.el8_9
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7467
show 15 more
  • Red Hat Enterprise Linux AppStream (v. 9) samba-client 4.18.6-101.el9_3, samba-winexe 4.18.6-101.el9_3, samba-vfs-iouring 4.18.6-101.el9_3, samba-krb5-printing 4.18.6-101.el9_3, samba-winbind-clients 4.18.6-101.el9_3, samba-winbind-krb5-locator 4.18.6-101.el9_3
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6744
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) samba-vfs-iouring 4.15.5-13.el8_6
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7408
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) samba-vfs-iouring 4.17.5-4.el8_8
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7464
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) samba-client 4.15.5-111.el9_0, samba-winexe 4.15.5-111.el9_0, samba-vfs-iouring 4.15.5-111.el9_0, samba-krb5-printing 4.15.5-111.el9_0, samba-winbind-clients 4.15.5-111.el9_0, samba-winbind-krb5-locator 4.15.5-111.el9_0
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6209
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) samba-client 4.17.5-104.el9_2, samba-winexe 4.17.5-104.el9_2, samba-vfs-iouring 4.17.5-104.el9_2, samba-krb5-printing 4.17.5-104.el9_2, samba-winbind-clients 4.17.5-104.el9_2, samba-winbind-krb5-locator 4.17.5-104.el9_2
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7371
  • Red Hat Enterprise Linux BaseOS (v. 8) ctdb 4.18.6-2.el8_9, samba 4.18.6-2.el8_9, libnetapi 4.18.6-2.el8_9, samba-libs 4.18.6-2.el8_9, samba-pidl 4.18.6-2.el8_9, samba-test 4.18.6-2.el8_9, +22 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7467
  • Red Hat Enterprise Linux BaseOS (v. 9) samba 4.18.6-101.el9_3, libnetapi 4.18.6-101.el9_3, samba-libs 4.18.6-101.el9_3, libwbclient 4.18.6-101.el9_3, samba-tools 4.18.6-101.el9_3, libsmbclient 4.18.6-101.el9_3, +12 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6744
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) ctdb 4.15.5-13.el8_6, samba 4.15.5-13.el8_6, samba-libs 4.15.5-13.el8_6, samba-pidl 4.15.5-13.el8_6, samba-test 4.15.5-13.el8_6, libwbclient 4.15.5-13.el8_6, +15 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7408
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) ctdb 4.17.5-4.el8_8, samba 4.17.5-4.el8_8, libnetapi 4.17.5-4.el8_8, samba-libs 4.17.5-4.el8_8, samba-pidl 4.17.5-4.el8_8, samba-test 4.17.5-4.el8_8, +22 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7464
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) samba 4.15.5-111.el9_0, samba-libs 4.15.5-111.el9_0, libwbclient 4.15.5-111.el9_0, libsmbclient 4.15.5-111.el9_0, samba-common 4.15.5-111.el9_0, python3-samba 4.15.5-111.el9_0, +5 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6209
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) samba 4.17.5-104.el9_2, libnetapi 4.17.5-104.el9_2, samba-libs 4.17.5-104.el9_2, libwbclient 4.17.5-104.el9_2, samba-tools 4.17.5-104.el9_2, libsmbclient 4.17.5-104.el9_2, +12 more
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7371
  • Red Hat Enterprise Linux Resilient Storage (v. 9) ctdb 4.18.6-101.el9_3
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6744
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) ctdb 4.15.5-111.el9_0
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:6209
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) ctdb 4.17.5-104.el9_2
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7371
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 samba 4.15.5-13.el8_6, libwbclient 4.15.5-13.el8_6, libsmbclient 4.15.5-13.el8_6, samba-common 4.15.5-13.el8_6, samba-client-libs 4.15.5-13.el8_6, samba-common-libs 4.15.5-13.el8_6
    fixed: vendor fix “To mitigate this vulnerability, disable rpcecho service on the AD DC by setting: ~~~ dcerpc endpoint servers = -rpcecho ~~~” RHSA-2023:7408

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Storage 3

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.