CVE-2014-0239

Name	CVE-2014-0239
Description	The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	749845

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
samba (PTS)	bookworm, bookworm (security)	2:4.17.12+dfsg-0+deb12u4	fixed
	trixie	2:4.22.11+dfsg-0+deb13u1	fixed
	trixie (security)	2:4.22.10+dfsg-0+deb13u2	fixed
	forky, sid	2:4.24.7+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
samba	source	squeeze	(not affected)
samba	source	wheezy	(not affected)
samba	source	(unstable)	2:4.1.8+dfsg-1	749845
samba4	source	(unstable)	4.0.0~beta2+dfsg1-3.2+deb7u2

Notes

[squeeze] - samba <not-affected> (AD feature not present)
[wheezy] - samba <not-affected> (AD feature not present)
AD-related packages removed from src:samba4 in 4.0.0~beta2+dfsg1-3.2+deb7u2