Описание
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).
Меры по смягчению последствий
This is an SMB1-only vulnerability. Since Samba release 4.11.0, SMB1 has been disabled by default. We do not recommend enabling SMB1 server support. For Samba versions prior to 4.11.0, please disable SMB1 by adding
to the [global] section of your smb.conf and restarting smbd.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | samba | Out of support scope | ||
| Red Hat Enterprise Linux 6 | samba4 | Out of support scope | ||
| Red Hat Enterprise Linux 7 | samba | Out of support scope | ||
| Red Hat Enterprise Linux 8 | samba | Fixed | RHSA-2022:7111 | 25.10.2022 |
| Red Hat Enterprise Linux 8 | samba | Fixed | RHSA-2022:7111 | 25.10.2022 |
| Red Hat Enterprise Linux 9 | samba | Fixed | RHSA-2022:8317 | 15.11.2022 |
| Red Hat Enterprise Linux 9 | samba | Fixed | RHSA-2022:8317 | 15.11.2022 |
| Red Hat Gluster Storage 3.5 for RHEL 8 | samba | Fixed | RHSA-2022:7056 | 19.10.2022 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | samba | Fixed | RHSA-2022:7111 | 25.10.2022 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).
A flaw was found in Samba. Some SMB1 write requests were not correctly ...
EPSS
4.3 Medium
CVSS3