USN-6425-3: Samba vulnerabilities

USN-6425-1 fixed vulnerabilities in Samba. This update provides the corresponding updates for Ubuntu 23.10. Original advisory details: Sri Nagasubramanian discovered that the Samba aclxattr VFS module incorrectly handled read-only files. When Samba is configured to ignore system ACLs, a remote...

SUSE-SU-2023:4084-1 Security update for netatalk

This update for netatalk fixes the following issues: - CVE-2022-22995: Fixed a flaw where combining primitives offered by SMB and AFP in their default configuration may allow an attacker to achieve arbitrary code execution. bsc1197576...

Fedora 38 : netatalk (2023-cec97f7b5d)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-cec97f7b5d advisory. 3.1.18 release Security fix for CVE-2022-22995 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

SUSE SLED15: ctdb / ctdb-pcp-pmda / libsamba-policy-devel / etc (SUSE-SU-2023:4059-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4059-1 advisory. - CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions...

Fedora 37 : netatalk (2023-ef901c862c)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ef901c862c advisory. 3.1.18 release Security fix for CVE-2022-22995 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

SUSE SLED15: ctdb / ctdb-pcp-pmda / libsamba-policy-devel / etc (SUSE-SU-2023:4046-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4046-1 advisory. - CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions...

Slackware: Security Advisory (SSA:2023-284-03)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-4091

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "aclxattr" is configured with "aclxattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only acces...

Use-after-free in Linux kernel's fs/smb/client component

...

Slackware Linux 15.0 / current samba Multiple Vulnerabilities (SSA:2023-284-03)

The version of samba installed on the remote host is prior to 4.18.8 / 4.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-284-03 advisory. - The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ Inter-Process Communication share for...

Debian DSA-5525-1 : samba - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5525 advisory. - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba...

Samba File Truncation Vulnerability (CVE-2023-3347)

Samba is prone to a file truncation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:samba:samba"; ifdescription...

smbd allows client access to unix domain sockets

Description The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ Inter-Process Communication share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0, Samba internally connects client pipe names to unix domain sockets within ...

SMB clients can truncate files with

Description The SMB protocol allows opening files where the client requests read-only access, but then implicitly truncating the opened file if the client specifies a separate OVERWRITE create disposition. This operation requires write access to the file, and in the default Samba configuration th...

CVE-2023-4091

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "aclxattr" is configured with "aclxattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only acces...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Samba vulnerabilities (USN-6425-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6425-1 advisory. Sri Nagasubramanian discovered that the Samba aclxattr VFS module incorrectly handled read-only files. When Samba is configured to...

Arbitrary Code Execution

netatalk is vulnerable to Arbitrary Code Execution. The vulnerability arises from the combination of primitives offered by SMB and AFP in their default configuration, enabling an attacker to inject and execute malicious code, resulting in arbitrary file write...

Slackware Linux 15.0 / current netatalk Vulnerability (SSA:2023-279-01)

The version of netatalk installed on the remote host is prior to 3.1.18. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-279-01 advisory. - The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By...

The vulnerability of the smb3_fs_context_parse_param() function in the fs/smb/client component of the Linux operating system allows a hacker to increase their privileges.

The vulnerability of the smb3fscontextparseparam function in the fs/smb/client component of the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2023-5345

A flaw was found in the SMB client component in the Linux kernel. In case of an error in smb3fscontextparseparam, ctx-password was freed, but the field was not set to NULL, potentially leading to a use-after-free vulnerability. This flaw allows a local user to crash or potentially escalate their...