Buffer Overflow Write when libntlm generates NTLM request

[Kirin]

CVE-2019-17455：
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

For further information see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17455
https://gitlab.com/jas/libntlm/issues/2

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Alex (afsonos)]

Heya!

Looks like upstream got this back in april.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145;msg=12

[Christian Ehrhardt  (paelzer)]

This was never in impish or later.
And fixed for active releases:
1.5-2ubuntu0.1) focal-security
1.4-8ubuntu0.1) bionic-security

Those uploads are available since ~October 2021, so it was just this bug that the security team wasn't aware of I guess.