Описание
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
Меры по смягчению последствий
Setting
in the smb.conf will provide some mitigation against this issue.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | samba | Not affected | ||
| Red Hat Enterprise Linux 7 | samba | Not affected | ||
| Red Hat Enterprise Linux 9 | samba | Not affected | ||
| Red Hat Enterprise Linux 8 | samba | Fixed | RHSA-2021:5082 | 13.12.2021 |
| Red Hat Enterprise Linux 8 | samba | Fixed | RHSA-2021:5082 | 13.12.2021 |
| Red Hat Enterprise Linux 8.4 Extended Update Support | samba | Fixed | RHSA-2022:0008 | 04.01.2022 |
| Red Hat Gluster Storage 3.5 for RHEL 8 | samba | Fixed | RHSA-2021:4843 | 29.11.2021 |
Показывать по
Дополнительная информация
Статус:
4.8 Medium
CVSS3
Связанные уязвимости
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
A flaw was found in the way samba implemented DCE/RPC. If a client to ...
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.
4.8 Medium
CVSS3