NVD Vulnerability Detail

CVE-2021-3671

Summary	A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
Publication Date	Oct. 13, 2021, 3:15 a.m.
Registration Date	Oct. 13, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:22 p.m.

Affected software configurations

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*
cpe:2.3:a:netapp:management_services_for_element_software:-:::::::*
cpe:2.3:a:netapp:management_services_for_netapp_hci:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=2013080%2C
2	https://bugzilla.redhat.com/show_bug.cgi?id=2013080%2C
3	https://bugzilla.samba.org/show_bug.cgi?id=14770%2C
4	https://bugzilla.samba.org/show_bug.cgi?id=14770%2C
5	https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a	Patch Third Party Advisory
6	https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a	Patch Third Party Advisory
7	https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html	Mailing List Third Party Advisory
8	https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html	Mailing List Third Party Advisory
9	https://security.netapp.com/advisory/ntap-20221215-0002/	Third Party Advisory
10	https://security.netapp.com/advisory/ntap-20221215-0002/	Third Party Advisory
11	https://security.netapp.com/advisory/ntap-20230216-0008/	Third Party Advisory
12	https://security.netapp.com/advisory/ntap-20230216-0008/	Third Party Advisory
13	https://www.debian.org/security/2022/dsa-5287	Third Party Advisory
14	https://www.debian.org/security/2022/dsa-5287	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-476	NULL ポインタデリファレンス	https://cwe.mitre.org/data/definitions/476.html

JVN Vulnerability Information

samba kerberos サーバにおける NULL ポインタデリファレンスに関する脆弱性

Title	samba kerberos サーバにおける NULL ポインタデリファレンスに関する脆弱性
Summary	samba kerberos サーバには、 NULL ポインタデリファレンスに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 27, 2021, midnight
Registration Date	Sept. 20, 2022, 1:46 p.m.
Last Update	Sept. 20, 2022, 1:46 p.m.

Affected System

Samba Project

Samba

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-3671	https://www.cve.org/CVERecord?id=CVE-2021-3671
National Vulnerability Database (NVD)
2	CVE-2021-3671	https://nvd.nist.gov/vuln/detail/CVE-2021-3671

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-476	http://cwe.mitre.org/data/definitions/476.html

ベンダー情報

No	Name	URL
GitHub
1	kdc: validate sname in TGS-REQ	https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a

Change Log

No	Changed Details	Date of change
1	[2022年09月20日] 掲載	Sept. 20, 2022, 1:44 p.m.