Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2022-45141

Опубликовано: 16 дек. 2022
Источник: redhat
CVSS3: 8.1
EPSS Низкий

Описание

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

Отчет

The samba package as shipped with Red Hat Enterprise Linux 6, 7, 8 and 9 and Red Hat Gluster is not affected by this issue as Red Hat doesn't provide the AD domain controller capability with it.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6sambaNot affected
Red Hat Enterprise Linux 7sambaNot affected
Red Hat Enterprise Linux 8sambaNot affected
Red Hat Enterprise Linux 9sambaNot affected
Red Hat Storage 3sambaNot affected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-326
https://bugzilla.redhat.com/show_bug.cgi?id=2154376samba: Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets

EPSS

Процентиль: 68%
0.00577
Низкий

8.1 High

CVSS3

Связанные уязвимости

CVSS3: 9.8
ubuntu
почти 3 года назад

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

CVSS3: 9.8
nvd
почти 3 года назад

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

CVSS3: 9.8
msrc
больше 1 года назад

Описание отсутствует

CVSS3: 9.8
debian
почти 3 года назад

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerabili ...

CVSS3: 9.8
github
почти 3 года назад

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

EPSS

Процентиль: 68%
0.00577
Низкий

8.1 High

CVSS3