OESA-2022-1817

Dashboard / Vulnerabilities / OESA-2022-1817

OESA-2022-1817

Summary: samba security update

Details: Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fix(es): A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746) A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742) A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744) As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC should only provide a ticket for kadmin/changepw but returns a krbtgt. So a user could skip the password change and just use the krbtgt to get service tickets and use services in the forest.(CVE-2022-2031)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1817, https://nvd.nist.gov/vuln/detail/CVE-2022-32746, https://nvd.nist.gov/vuln/detail/CVE-2022-32742, https://nvd.nist.gov/vuln/detail/CVE-2022-32744, https://nvd.nist.gov/vuln/detail/CVE-2022-2031