Vulnerability record · CVE-2014-0239 · published 28 May 2014

CVE-2014-0239: Samba Internal DNS Server Missing QR Field Check Enables DoS Loop

Samba · Samba

Samba 4.x before 4.0.18 fails to validate the QR field in the header of incoming DNS messages before responding. A forged response packet can therefore trigger a communication loop between DNS servers, consuming CPU and bandwidth. The flaw is a missing input validation issue related to CVE-1999-0103.

5.0 CVSS 2.0 Medium EPSS 67% · top 0.7% CWE-20 · Improper input validation

5.0CVSS 2.0 base score

67%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References

17 Jun 2026Last modified by NVD

Description

The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.

AV:N/AC:L/Au:N/C:N/I:N/A:P

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS 2.0 base score is 5.0 (MEDIUM) with only partial availability impact, but the high EPSS percentile and remote unauthenticated reachability warrant prompt patching.

What it is

Impact

A remote, unauthenticated attacker can cause a denial of service through sustained CPU and bandwidth consumption on the affected Samba internal DNS server and any peer drawn into the loop.

Attack surface

Reachable over the network via DNS traffic to the Samba internal DNS server; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.66811 (99.256th percentile), indicating elevated predicted exploitation likelihood.

What to do

Upgrade Samba to 4.0.18 or later, which contains the fix for CVE-2014-0239.
If immediate upgrade is not possible, restrict DNS service exposure to trusted networks only.
Apply vendor or distribution patches (e.g., Gentoo GLSA-201502-15) where available.
Monitor DNS server resource usage and rate-limit or filter anomalous DNS response traffic.

Detection

Monitor Samba internal DNS server logs for repeated or looping query/response patterns between DNS peers.
Alert on sustained high CPU or bandwidth usage on Samba DNS hosts without a matching legitimate query load.
Inspect DNS traffic for response packets with unexpected QR field values or malformed headers reaching the Samba DNS service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Samba Samba

References

Link	Tags
http://secunia.com/advisories/59579	Third Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xml	Third Party Advisory
http://www.samba.org/samba/security/CVE-2014-0239	Vendor Advisory
http://www.securityfocus.com/bid/67691	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1030309	Third Party AdvisoryVDB Entry
http://secunia.com/advisories/59579	Third Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xml	Third Party Advisory
http://www.samba.org/samba/security/CVE-2014-0239	Vendor Advisory
http://www.securityfocus.com/bid/67691	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1030309	Third Party AdvisoryVDB Entry

Track CVE-2014-0239 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-7494Samba writable share library upload leads to remote code executionSamba versions from 3.5.0 up to (but not including) 4.6.4, 4.5.10 and 4.4.14 allow a malicious client to upload a shared library to a writable share …KEVEPSS 99%analysed30 May 2017 5.5CVE-2020-1472Microsoft Netlogon elevation of privilege via vulnerable secure channel (Zerologon)CVE-2020-1472 is an elevation of privilege flaw in Microsoft's Netlogon Remote Protocol (MS-NRPC) where an attacker can establish a vulnerable Netlog…KEVEPSS 99%analysed17 Aug 2020 10.0CVE-2015-0240Samba Netlogon ServerPasswordSet RPC uninitialized pointer code executionSamba's smbd Netlogon server frees an uninitialized stack pointer when handling crafted ServerPasswordSet RPC requests. This memory corruption flaw a…EPSS 88%analysed24 Feb 2015 10.0CVE-2012-1182Samba RPC code generator array length validation flaw allows remote code executionThe RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 validates an array length inconsistently with how it v…EPSS 74%analysed10 Apr 2012 10.0CVE-2007-2446Samba smbd NDR parsing heap buffer overflows allow remote code executionSamba 3.0.0 through 3.0.25rc3 contains multiple heap-based buffer overflows in the NDR parsing code of smbd, reachable through crafted MS-RPC request…EPSS 78%analysed14 May 2007 10.0CVE-2004-0882Samba vulnerabilityBuffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a TRANSACT…EPSS 14%27 Jan 2005 10.0CVE-2004-1154Samba vulnerabilityInteger overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (appl…EPSS 13%10 Jan 2005 10.0CVE-2004-0600Samba vulnerabilityBuffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid …EPSS 29%27 Jul 2004

Source: NIST National Vulnerability Database (record CVE-2014-0239), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.