Lucene search

K
ubuntuUbuntuUSN-6425-1
HistoryOct 10, 2023 - 12:00 a.m.

Samba vulnerabilities

2023-10-1000:00:00
ubuntu.com
43
samba server
ubuntu
vulnerabilities
remote attack
denial of service
cve-2023-4091
cve-2023-4154
cve-2023-42669
rpc listeners

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

Releases

  • Ubuntu 23.04
  • Ubuntu 22.04 LTS
  • Ubuntu 20.04 LTS

Packages

  • samba - SMB/CIFS file, print, and login server for Unix

Details

Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)

Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)

Andrew Bartlett discovered that Samba incorrectly handled the rpcecho
development server. A remote attacker could possibly use this issue to
cause Samba to stop responding, resulting in a denial of service.
(CVE-2023-42669)

Kirin van der Veer discovered that Samba incorrectly handled certain RPC
service listeners. A remote attacker could possibly use this issue to cause
Samba to start multiple incompatible RPC listeners, resulting in a denial
of service. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.
(CVE-2023-42670)

OSVersionArchitecturePackageVersionFilename
Ubuntu23.04noarchsamba< 2:4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchctdb< 2:4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchctdb-dbgsym< 2:4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchldb-tools< 2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchldb-tools-dbgsym< 2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchlibldb-dev< 2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchlibldb2< 2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchlibldb2-dbgsym< 2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchlibnss-winbind< 2:4.17.7+dfsg-1ubuntu2.3UNKNOWN
Ubuntu23.04noarchlibnss-winbind-dbgsym< 2:4.17.7+dfsg-1ubuntu2.3UNKNOWN
Rows per page:
1-10 of 1121

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%