Описание
Security update for samba
This update for samba fixes the following issues:
Version update to 4.15.12.
Security issues fixed:
- CVE-2022-2031: Fixed AD users that could have bypassed certain restrictions associated with changing passwords (bsc#1201495).
- CVE-2022-32742: Fixed SMB1 code that does not correctly verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths (bsc#1201496).
- CVE-2022-32744: Fixed AD users that could have forged password change requests for any user (bsc#1201493).
- CVE-2022-32745: Fixed AD users that could have crashed the server process with an LDAP add or modify request (bsc#1201492).
- CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
- CVE-2022-3437: Fixed buffer overflow in Heimdal unwrap_des3() (bsc#1204254).
- CVE-2022-42898: Fixed Samba buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).
Bug fixes:
- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory (bsc#1201689).
- Possible use after free of connection_struct when iterating smbd_server_connection->connections (bsc#1200102).
Список пакетов
Image SLES15-SP3-BYOS-Azure
Image SLES15-SP3-BYOS-EC2-HVM
Image SLES15-SP3-BYOS-GCE
Image SLES15-SP3-CHOST-BYOS-Aliyun
Image SLES15-SP3-CHOST-BYOS-Azure
Image SLES15-SP3-CHOST-BYOS-EC2
Image SLES15-SP3-CHOST-BYOS-GCE
Image SLES15-SP3-CHOST-BYOS-SAP-CCloud
Image SLES15-SP3-HPC-BYOS-Azure
Image SLES15-SP3-HPC-BYOS-EC2-HVM
Image SLES15-SP3-HPC-BYOS-GCE
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM
Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production
Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP3-SAP-BYOS-Azure
Image SLES15-SP3-SAP-BYOS-EC2-HVM
Image SLES15-SP3-SAP-BYOS-GCE
Image SLES15-SP3-SAPCAL-Azure
Image SLES15-SP3-SAPCAL-EC2-HVM
Image SLES15-SP3-SAPCAL-GCE
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise High Availability Extension 15 SP3
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Basesystem 15 SP3
SUSE Linux Enterprise Module for Python 2 15 SP3
openSUSE Leap 15.3
openSUSE Leap Micro 5.2
Ссылки
- Link for SUSE-SU-2022:4395-1
- E-Mail link for SUSE-SU-2022:4395-1
- SUSE Security Ratings
- SUSE Bug 1200102
- SUSE Bug 1201490
- SUSE Bug 1201492
- SUSE Bug 1201493
- SUSE Bug 1201495
- SUSE Bug 1201496
- SUSE Bug 1201689
- SUSE Bug 1204254
- SUSE Bug 1205126
- SUSE CVE CVE-2022-2031 page
- SUSE CVE CVE-2022-32742 page
- SUSE CVE CVE-2022-32744 page
- SUSE CVE CVE-2022-32745 page
- SUSE CVE CVE-2022-32746 page
- SUSE CVE CVE-2022-3437 page
- SUSE CVE CVE-2022-42898 page
Описание
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.
Затронутые продукты
Ссылки
- CVE-2022-2031
- SUSE Bug 1201495
- SUSE Bug 1202815
- SUSE Bug 1202999
- SUSE Bug 1205061
- SUSE Bug 1208433
- SUSE Bug 1209664
Описание
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).
Затронутые продукты
Ссылки
- CVE-2022-32742
- SUSE Bug 1201496
- SUSE Bug 1202815
Описание
A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.
Затронутые продукты
Ссылки
- CVE-2022-32744
- SUSE Bug 1201493
- SUSE Bug 1202815
- SUSE Bug 1209664
Описание
A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.
Затронутые продукты
Ссылки
- CVE-2022-32745
- SUSE Bug 1201492
Описание
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.
Затронутые продукты
Ссылки
- CVE-2022-32746
- SUSE Bug 1201490
Описание
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.
Затронутые продукты
Ссылки
- CVE-2022-3437
- SUSE Bug 1204254
- SUSE Bug 1205667
- SUSE Bug 1208992
Описание
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
Затронутые продукты
Ссылки
- CVE-2022-42898
- SUSE Bug 1205126
- SUSE Bug 1205667
- SUSE Bug 1207423
- SUSE Bug 1207690
- SUSE Bug 1211487
- SUSE Bug 1225675