Back to Database
Status published
Critical
CVE-2019-17455
Libntlm through 1.5 relies on a fixed buffer size for...
Vulnerability Description
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-17455
Credits & Attribution
No credits recorded in the NVD database.
References
- https://gitlab.com/jas/libntlm/issues/2
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.html
- https://security-tracker.debian.org/tracker/CVE-2019-17455
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145
- https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/
- https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html
More from nongnu
View All →CVE-2018-1000637
zutils version prior to version 1.8-pre2 contains a Buffer Overflow...
High
7.8
CVE-2014-2886
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double...
Medium
6.8
CVE-2013-7322
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not...
Medium
4.9
CVE-2010-3846
Array index error in the apply_rcs_change function in rcs.c in...
Medium
6.9
CVE-2009-0359
Multiple cross-site scripting (XSS) vulnerabilities in Samizdat before 0.6.2 allow...
Low
3.5
Affected Vendor
nongnu
View all reports →Affected Software
libntlm, debian linux, ubuntu linux, fedora, backports sle, leap
Vulnerable Versions:
0, 8.0, 9.0, 14.04, 16.04, 18.04, 20.04, 32, 33, 15.0, 15.1
Timeline
Official Publish:
October 10th, 2019
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.