Описание
Security update for samba
This update for samba fixes the following issues:
Update to 4.22.11.
Security issues fixed:
- CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the
user.SmbReparsexattr (bsc#1261188). - CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
- CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
- CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
- CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
- CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
- CVE-2026-15779:
pam_winbindmodule withmkhomedirset allowschownof critical system paths without validation (bsc#1271469). - CVE-2026-58216: 6-byte heap OOB read in packet parser of the
kpasswdservice (bsc#1271674). - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).
Other updates and bugfixes:
samba-tool: do not complain of no subcommand with-V(bsc#1273189, bso#15770).- Add
python3-cryptographyandpython3-requestsrequirements forsamba-python3.
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1261158
- SUSE Bug 1261159
- SUSE Bug 1261160
- SUSE Bug 1261161
- SUSE Bug 1261163
- SUSE Bug 1261188
- SUSE Bug 1271469
- SUSE Bug 1271672
- SUSE Bug 1271673
- SUSE Bug 1271674
- SUSE Bug 1271675
- SUSE Bug 1271676
- SUSE Bug 1271677
- SUSE Bug 1273189
- SUSE CVE CVE-2026-15779 page
- SUSE CVE CVE-2026-1933 page
- SUSE CVE CVE-2026-2340 page
- SUSE CVE CVE-2026-3012 page
- SUSE CVE CVE-2026-3238 page
Описание
A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
Затронутые продукты
Ссылки
- CVE-2026-15779
- SUSE Bug 1271469
Описание
A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
Затронутые продукты
Ссылки
- CVE-2026-1933
- SUSE Bug 1261188
Описание
A flaw was found in Samba's vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
Затронутые продукты
Ссылки
- CVE-2026-2340
- SUSE Bug 1261158
Описание
A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.
Затронутые продукты
Ссылки
- CVE-2026-3012
- SUSE Bug 1261159
Описание
A flaw was found in Samba's WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.
Затронутые продукты
Ссылки
- CVE-2026-3238
- SUSE Bug 1261160
Описание
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Затронутые продукты
Ссылки
- CVE-2026-4408
- SUSE Bug 1261163
- SUSE Bug 1267999
- SUSE Bug 1272967
Описание
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
Затронутые продукты
Ссылки
- CVE-2026-4480
- SUSE Bug 1261161
- SUSE Bug 1267999
- SUSE Bug 1272967
Описание
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-58216
- SUSE Bug 1271674
Описание
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-58218
- SUSE Bug 1271675
Описание
unknown
Затронутые продукты
Ссылки
- CVE-2026-58221
- SUSE Bug 1271676
Описание
A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.
Затронутые продукты
Ссылки
- CVE-2026-58222
- SUSE Bug 1271677
Описание
unknown
Затронутые продукты
Ссылки
- CVE-2026-58224
- SUSE Bug 1271673
Описание
unknown
Затронутые продукты
Ссылки
- CVE-2026-6949
- SUSE Bug 1271672
- SUSE Bug 1271675