What’s Vulnerable › Vulnerabilities
CVE-2019-17455
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-10-10 · updated 2026-06-17
- Weakness: CWE-125
Description
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.
Affected products
- Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
- Debian Linux: 8.0, 9.0
- Fedoraproject Fedora: 32, 33
- Nongnu Libntlm: through 1.5
- openSUSE Backports Sle: 15.0-sp1
- openSUSE Leap: 15.1
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145
- https://gitlab.com/jas/libntlm/issues/2
- https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.html
- https://security-tracker.debian.org/tracker/CVE-2019-17455
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html
Get alerted when CVE-2019-17455 or the next vulnerability affects your stack