===========================================================
== Subject: TSIG packet with name compression can crash DNS
==
== CVE ID#: CVE-2026-6949
==
== Versions: All versions since 4.0
==
== Summary: Incorrect size calculations when a TSIG record
contains compressed names can lead to a large
out-of-bounds write causing the server to crash.
===========================================================
===========
Description
===========
To calculate the size of a DNS packet region signed by a TSIG record,
Samba's internal DNS server subtracted the presumed size of the TSIG
record. In cases where the record used name compression, an incorrect
calculation could be made. Usually this manifests as a signing
failure, but in extreme cases the TSIG record was assumed to be bigger
than the entire packet, wrapping the presumed size of the signed
portion to a very large integer. Efforts to copy this portion
inevitably hit unallocated memory.
==================
Patch Availability
==================
Patches addressing this issue have been posted to:
https://www.samba.org/samba/security/
Additionally, Samba $VERSIONS have been issued
as security releases to correct the defect. Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.
==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5)
==========
Workaround
==========
The BIND9 DLZ is not affected.
=======
Credits
=======
Originally reported by Arjun Basnet of Securin Labs, with further
analysis by Douglas Bagnall of Catalyst and the Samba team.
Also reported by Andrew Tridgell of the Samba Team.
Patches provided by Stefan Metzmacher of the Samba team.
==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================