CoreCVE
Back

MEDIUM

samba: AD DC check password script does not receive full password when non-ASCII characters are used

Published Nov 6, 2019

Description

A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.

Affected products

Remediation

Red Hat statement

This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux because there is no support for samba as Active Directory Domain Controller.

Red Hat mitigation

If the check password script parameter is not specified, Samba runs the internal password quality checks. The internal check makes sure that a password contains characters from three of five different characters categories.

Metrics

Weaknesses (2)

CWE-305

CWE-521

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Nov 6, 2019
Updated Aug 5, 2024
Reserved Aug 10, 2019
Link CVE-2019-14833
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-14833
Red Hat
Severity Moderate
Public date Oct 29, 2019
Links CVE-2019-14833 - Bugzilla