Описание
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| heimdal | fixed | 7.7.0+dfsg-3 | package | |
| heimdal | no-dsa | stretch | package | |
| samba | fixed | 2:4.13.13+dfsg-1 | package | |
| samba | fixed | 2:4.13.13+dfsg-1~deb11u1 | bullseye | package |
| samba | ignored | buster | package | |
| samba | no-dsa | stretch | package |
Примечания
https://bugzilla.redhat.com/show_bug.cgi?id=2013080
https://bugzilla.samba.org/show_bug.cgi?id=14770
https://github.com/heimdal/heimdal/security/advisories/GHSA-h9qj-cpmq-3562
Fixed by: https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
Followup: https://github.com/heimdal/heimdal/commit/773802aecfb4b6a73817fa522faeb55b2a7cdb2a
"Equivalent" issue for CVE-2021-37750 for the MIT krb5 vulnerability.
Fixed by (Samba): https://gitlab.com/samba-team/samba/-/commit/0cb4b939f192376bf5e33637863a91a20f74c5a5
EPSS
Связанные уязвимости
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
EPSS