CVE-2021-23192 – samba: Subsequent DCE/RPC fragment injection vulnerability

https://notcve.org/view.php?id=CVE-2021-23192

11 Nov 2021 — A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements. Se ha encontrado un fallo en la forma en que samba implementa DCE/RPC. Si un cliente a un servidor Samba enviaba una petición DCE/RPC muy grande, y elegía fragmentarla, un atacante podía reemplazar los fragmentos posteriores con sus propios datos, omitiendo los req... • https://bugzilla.redhat.com/show_bug.cgi?id=2019666 • CWE-20: Improper Input Validation •

CVE-2020-25718 – Gentoo Linux Security Advisory 202309-06

https://notcve.org/view.php?id=CVE-2020-25718

11 Nov 2021 — A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets. Se encontró un fallo en la forma en que samba, como controlador de dominio de Active Directory, es capaz de soportar un RODC (controlador de dominio de sólo lectura). Esto permitiría a un RODC imprimir tickets de administrador Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote... • https://bugzilla.redhat.com/show_bug.cgi?id=2019726 • CWE-862: Missing Authorization •

CVE-2021-3671 – Ubuntu Security Notice USN-5142-2

https://notcve.org/view.php?id=CVE-2021-3671

12 Oct 2021 — A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server. Se ha encontrado una desreferencia de puntero null en la forma en que el servidor kerberos de Samba manejaba el sname faltante en TGS-REQ (Ticket Granting Server - Request). Un usuario autenticado podría usar este fallo para bloquear el servidor samba Isaac Boukris and Andrew Bartlett discovered that H... • https://bugzilla.redhat.com/show_bug.cgi?id=2013080%2C • CWE-476: NULL Pointer Dereference •

CVE-2021-20254 – samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token

https://notcve.org/view.php?id=CVE-2021-20254

30 Apr 2021 — A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity. • https://bugzilla.redhat.com/show_bug.cgi?id=1949442 • CWE-125: Out-of-bounds Read •

CVE-2020-27840 – Ubuntu Security Notice USN-4888-2

https://notcve.org/view.php?id=CVE-2020-27840

25 Mar 2021 — A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability. Se ha encontrado un fallo en samba. Los espacios usados en una cadena alrededor de un nombre de dominio (DN), aunque se supone que deben ser ignorados, pueden causar cadenas DN no válidas con espacios en lugar ... • https://bugzilla.redhat.com/show_bug.cgi?id=1941400 • CWE-125: Out-of-bounds Read •

CVE-2021-20277 – samba: Out of bounds read in AD DC LDAP server

https://notcve.org/view.php?id=CVE-2021-20277

25 Mar 2021 — A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability. Se encontró un fallo en libldb de Samba. Múltiples espacios iniciales consecutivos en un atributo LDAP pueden conllevar a una escritura de memoria fuera de los límites, conllevando a un bloqueo del proceso del servidor LDAP que maneja la... • https://bugzilla.redhat.com/show_bug.cgi?id=1941402 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •

CVE-2020-17049 – Kerberos KDC Security Feature Bypass Vulnerability

https://notcve.org/view.php?id=CVE-2020-17049

11 Nov 2020 —

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).

To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Vulnerabilidad d... • http://www.openwall.com/lists/oss-security/2021/11/10/3 • CWE-345: Insufficient Verification of Data Authenticity CWE-863: Incorrect Authorization •

CVE-2020-14318 – samba: Missing handle permissions check in SMB1/2/3 ChangeNotify

https://notcve.org/view.php?id=CVE-2020-14318

02 Nov 2020 — A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. Se encontró un fallo en la manera en que samba manejaba los permisos de archivos y directorios. Un usuario autenticado podría usar este fallo para conseguir acceso a determinada información de archivos y directorios que de otra manera no estaría disponible para el atacante A flaw... • https://bugzilla.redhat.com/show_bug.cgi?id=1892631 • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •

CVE-2020-14383 – Ubuntu Security Notice USN-4931-1

https://notcve.org/view.php?id=CVE-2020-14383

02 Nov 2020 — A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not. Se encontró un fallo en el servidor DNS de samba. • https://bugzilla.redhat.com/show_bug.cgi?id=1892636 • CWE-391: Unchecked Error Condition •

CVE-2020-14323 – samba: Unprivileged user can crash winbind

https://notcve.org/view.php?id=CVE-2020-14323

29 Oct 2020 — A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service. Se encontró uno fallo de desreferencia del puntero null en el servicio Winbind de samba en versiones anteriores a 4.11.15, 4.12.9 y 4.13.1. Un usuario local podría utilizar este fallo para bloquear el servicio winbind causando una denegación de servicio A null pointer dereference flaw wa... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00008.html • CWE-170: Improper Null Termination CWE-476: NULL Pointer Dereference •