CVE-2014-0195

What it actually does

The dtls1_reassemble_fragment function fails to validate lengths of non-initial fragments in DTLS ClientHello messages, enabling a buffer overflow that can lead to arbitrary code execution or application crash.

Why it matters to the business

Attackers can remotely compromise or disrupt services relying on affected OpenSSL versions in Samba deployments, risking data exposure, system takeover, or downtime; the flaw has been weaponized with extremely high exploit probability despite its age.

How an attack unfolds

An attacker sends a specially crafted DTLS ClientHello containing an oversized non-initial fragment to trigger the missing length check in dtls1_reassemble_fragment, overflowing the buffer and either executing attacker-supplied code or crashing the process.

How to fix it

Upgrade Samba packages to the fixed versions provided for each Debian release (2:3.4.2-1 on Debian 11/12/13) or apply equivalent OpenSSL patches that correct fragment length validation in dtls1_reassemble_fragment.

How to confirm the fix worked

Confirm the installed Samba/OpenSSL packages match or exceed the listed fixed versions and test DTLS handshake handling with malformed fragments in a lab environment to verify absence of overflow conditions.

Typical attack path

1. Identify reachable DTLS endpoints using affected OpenSSL in Samba
2. Craft a DTLS ClientHello with an excessively long non-initial fragment
3. Transmit the malformed packet over the network
4. Trigger buffer overflow to achieve code execution or denial of service

How to detect it

Review historical network captures and application logs around DTLS handshake events for oversized or malformed ClientHello fragments; examine crash dumps or process terminations in OpenSSL/Samba DTLS code paths for indicators of buffer overflow attempts.

What your security team should do

• Immediately inventory all systems using the listed Samba packages and schedule upgrades to the fixed versions
• Prioritize patching due to weaponized exploit maturity and near-certain EPSS score
• Disable DTLS support where not required until patches are applied
• Monitor for any renewed exploitation attempts despite the vulnerability's age