Lucene search

K
ubuntuUbuntuUSN-6425-3
HistoryOct 17, 2023 - 12:00 a.m.

Samba vulnerabilities

2023-10-1700:00:00
ubuntu.com
31
samba
vulnerabilities
ubuntu 23.10
smb/cifs
unix
security advisory
denial of service
remote attacker
rpc listeners

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

Releases

  • Ubuntu 23.10

Packages

  • samba - SMB/CIFS file, print, and login server for Unix

Details

USN-6425-1 fixed vulnerabilities in Samba. This update provides the
corresponding updates for Ubuntu 23.10.

Original advisory details:

Sri Nagasubramanian discovered that the Samba acl_xattr VFS module
incorrectly handled read-only files. When Samba is configured to ignore
system ACLs, a remote attacker could possibly use this issue to truncate
read-only files. (CVE-2023-4091)

Andrew Bartlett discovered that Samba incorrectly handled the DirSync
control. A remote attacker with an RODC DC account could possibly use this
issue to obtain all domain secrets. (CVE-2023-4154)

Andrew Bartlett discovered that Samba incorrectly handled the rpcecho
development server. A remote attacker could possibly use this issue to
cause Samba to stop responding, resulting in a denial of service.
(CVE-2023-42669)

Kirin van der Veer discovered that Samba incorrectly handled certain RPC
service listeners. A remote attacker could possibly use this issue to cause
Samba to start multiple incompatible RPC listeners, resulting in a denial
of service. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.
(CVE-2023-42670)

OSVersionArchitecturePackageVersionFilename
Ubuntu23.10noarchsamba< 2:4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchctdb< 2:4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchctdb-dbgsym< 2:4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchldb-tools< 2:2.7.2+samba4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchldb-tools-dbgsym< 2:2.7.2+samba4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchlibldb-dev< 2:2.7.2+samba4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchlibldb2< 2:2.7.2+samba4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchlibldb2-dbgsym< 2:2.7.2+samba4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchlibnss-winbind< 2:4.18.6+dfsg-1ubuntu2.1UNKNOWN
Ubuntu23.10noarchlibnss-winbind-dbgsym< 2:4.18.6+dfsg-1ubuntu2.1UNKNOWN
Rows per page:
1-10 of 441

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%