CVE-2023-4154

Samba: ad dc password exposure to privileged users and rodcs

A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Storage Samba

CVE-2022-3437

samba: heap buffer overflow in GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

CVSS 3.1 · 4.3 Medium EPSS 4.0% KEV · Not listed

Vendors

Fedoraproject Samba

Products

Fedora Samba

CVE-2022-32746

samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Samba

CVE-2022-32745

samba: AD users can crash the server process with an LDAP add or modify request

A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2022-32744

samba: AD users can forge password change requests for any user

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2022-32742

samba: server memory information leak via SMB1

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).

CVSS 3.1 · 4.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Rhev Hypervisor Storage and 1 more

CVE-2022-2031

samba: kpasswd authentication with canonicalization enabled against Samba AD DC with Heimdal returns a krbtgt

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2022-0336

samba: Samba AD users with permission to write to an account can impersonate arbitrary services

The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Fedoraproject Samba

Products

Fedora Samba

CVE-2021-44141

samba: Information leak via symlinks of existance of files or directories outside of the exported share

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Fedoraproject Redhat Samba

Products

Fedora Enterprise Linux Storage and 1 more

CVE-2021-43566

samba: Symlink race error can allow directory creation outside of the exported share

All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Samba

CVE-2021-3738

samba: Use after free in Samba AD DC RPC server

In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2021-3671

samba: Null pointer dereference on missing sname in TGS-REQ

A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Netapp Samba

Products

Debian Linux Management Services For Element Software Management Services For Netapp Hci and 2 more

CVE-2021-23192

samba: Subsequent DCE/RPC fragment injection vulnerability

A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Rhel Eus Storage and 1 more

CVE-2021-20316

samba: Symlink race error can allow metadata read and modify outside of the exported share

A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.

CVSS 3.1 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Redhat Samba

Products

Debian Linux Enterprise Linux Enterprise Linux Aus and 5 more

CVE-2021-20277

samba: Out of bounds read in AD DC LDAP server

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 5 more

CVE-2021-20254

samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 6 more

CVE-2020-27840

samba: Heap corruption via crafted DN strings

A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Debian Fedoraproject Samba

Products

Debian Linux Fedora Samba

CVE-2020-25722

samba: Samba AD DC did not do sufficient access and conformance checking of data stored

Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 1 more

Products

Ubuntu Linux Debian Linux Fedora and 1 more

CVE-2020-25721

samba: Kerberos acceptors need easy access to stableAD identifiers (eg objectSid)

Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2020-25719

samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 15 more