{"id":"CVE-2014-0239","aliases":["DEBIAN-CVE-2014-0239","EUVD-2014-0277","GHSA-4rm5-v8f4-mx8v","UBUNTU-CVE-2014-0239","USN-2257-1","openSUSE-SU-2024:10069-1"],"status":"published","title":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header...","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.66811,"percentile":0.99298,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-05-28T00:00:00Z","modified":"2026-10-23T15:47:35Z","fixes":[{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.1.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.1.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.1.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"samba","fixed_in":["2:4.1.6+dfsg-1ubuntu2.14.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.6+dfsg-1ubuntu2.14.04.2"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.6+dfsg-1ubuntu2.14.04.2"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.1"}]}],"bundled":56}],"products":[{"vendor":"samba","product":"samba"}],"references":[{"url":"http://www.samba.org/samba/security/CVE-2014-0239","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://security.gentoo.org/glsa/glsa-201502-15.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/67691","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://secunia.com/advisories/59579","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1030309","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0239"},{"url":"https://github.com/advisories/GHSA-4rm5-v8f4-mx8v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0239","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0239","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2257-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3493","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2119","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0239","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","status":"published","published":"2014-05-28T01:00:00Z","modified":"2024-08-06T09:05:39.369Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-0277","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","status":"published","published":"2014-05-28T01:00:00Z","modified":"2024-08-06T09:05:39Z","updated_at":"2026-11-03T01:57:22.035163Z"}],"ghsa":[{"id":"GHSA-4rm5-v8f4-mx8v","title":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header...","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","status":"published","published":"2022-05-17T03:07:05Z","modified":"2023-01-27T05:07:23Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:06.43436Z"}],"nvd":[{"id":"CVE-2014-0239","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","status":"published","published":"2014-05-28T04:58:32.75Z","modified":"2026-06-17T00:02:37.413Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"CVE-2014-0239","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","status":"published","published":"2014-05-28T04:58:32Z","modified":"2026-04-10T03:43:33.585208Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0239","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","status":"published","published":"2014-05-28T04:58:32.75Z","modified":"2026-10-23T15:47:35.975105115Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"openSUSE-SU-2024:10069-1","title":"ctdb-4.5.0-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:47:57.807269Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-0239","description":"The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.","status":"published","published":"2014-05-28T00:00:00Z","modified":"2026-04-22T09:29:02.861229Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2257-1","title":"samba vulnerabilities","description":"Christof Schmitt discovered that Samba incorrectly initialized a certain\nresponse field when vfs shadow copy was enabled. A remote authenticated\nattacker could use this issue to possibly obtain sensitive information.\nThis issue only affected Ubuntu 13.10 and Ubuntu 14.04 LTS. (CVE-2014-0178)\n\nIt was discovered that the Samba internal DNS server incorrectly handled QR\nfields when processing incoming DNS messages. A remote attacker could use\nthis issue to cause Samba to consume resources, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0239)\n\nDaniel Berteaud discovered that the Samba NetBIOS name service daemon\nincorrectly handled certain malformed packets. A remote attacker could use\nthis issue to cause Samba to consume resources, resulting in a denial of\nservice. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and\nUbuntu 14.04 LTS. (CVE-2014-0244)\n\nSimon Arlott discovered that Samba incorrectly handled certain unicode path\nnames. A remote authenticated attacker could use this issue to cause Samba\nto stop responding, resulting in a denial of service. (CVE-2014-3493)\n","status":"published","published":"2014-06-26T17:30:11Z","modified":"2026-04-22T08:55:39.872713Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}