CVE-2020-17049 – Kerberos KDC Security Feature Bypass Vulnerability

https://notcve.org/view.php?id=CVE-2020-17049

11 Nov 2020 —

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).

To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Vulnerabilidad d... • http://www.openwall.com/lists/oss-security/2021/11/10/3 • CWE-345: Insufficient Verification of Data Authenticity CWE-863: Incorrect Authorization •

CVE-2020-14318 – samba: Missing handle permissions check in SMB1/2/3 ChangeNotify

https://notcve.org/view.php?id=CVE-2020-14318

02 Nov 2020 — A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. Se encontró un fallo en la manera en que samba manejaba los permisos de archivos y directorios. Un usuario autenticado podría usar este fallo para conseguir acceso a determinada información de archivos y directorios que de otra manera no estaría disponible para el atacante A flaw... • https://bugzilla.redhat.com/show_bug.cgi?id=1892631 • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •

CVE-2020-14383 – Ubuntu Security Notice USN-4931-1

https://notcve.org/view.php?id=CVE-2020-14383

02 Nov 2020 — A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not. Se encontró un fallo en el servidor DNS de samba. • https://bugzilla.redhat.com/show_bug.cgi?id=1892636 • CWE-391: Unchecked Error Condition •

CVE-2020-14323 – samba: Unprivileged user can crash winbind

https://notcve.org/view.php?id=CVE-2020-14323

29 Oct 2020 — A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service. Se encontró uno fallo de desreferencia del puntero null en el servicio Winbind de samba en versiones anteriores a 4.11.15, 4.12.9 y 4.13.1. Un usuario local podría utilizar este fallo para bloquear el servicio winbind causando una denegación de servicio A null pointer dereference flaw wa... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00008.html • CWE-170: Improper Null Termination CWE-476: NULL Pointer Dereference •

CVE-2020-1472 – Microsoft Netlogon Privilege Escalation Vulnerability

https://notcve.org/view.php?id=CVE-2020-1472

17 Aug 2020 — An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the... • https://packetstorm.news/files/id/180777 • CWE-287: Improper Authentication CWE-330: Use of Insufficiently Random Values •

CVE-2020-14303 – Ubuntu Security Notice USN-4454-1

https://notcve.org/view.php?id=CVE-2020-14303

06 Jul 2020 — A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash. Se encontró un fallo en el servidor AD DC NBT en todas las versiones de Samba anteriores a 4.10.17, anteriores a 4.11.11 y anteriores a 4.12.4. Un usuario de samba podría enviar un paquete UDP vacío para hacer que el servidor de samba se bloquee USN-4454-1 fixed a vulnerability in Samba. This update provides the corre... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html • CWE-834: Excessive Iteration •

CVE-2020-10730 – samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results

https://notcve.org/view.php?id=CVE-2020-10730

02 Jul 2020 — A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability. Se encontró una desrefer... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html • CWE-416: Use After Free CWE-476: NULL Pointer Dereference •

CVE-2020-10745 – Ubuntu Security Notice USN-4409-1

https://notcve.org/view.php?id=CVE-2020-10745

02 Jul 2020 — A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability. Se encontró un fallo en todas las versiones de Samba anteriores a 4.10.17, anteriores a 4.11.11 y anteriores a 4.12.4 en la manera en que procesaba NetBios sobre TCP/IP. Este fa... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html • CWE-400: Uncontrolled Resource Consumption •

CVE-2020-10760 – Ubuntu Security Notice USN-4409-1

https://notcve.org/view.php?id=CVE-2020-10760

02 Jul 2020 — A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba. Se encontró un fallo de uso de la memoria previamente liberada en todas las versiones del servidor LDAP de samba anteriores a 4.10.17, anteriores a 4.11.11, anteriores a 4.12.4, usado en una configuración AC DC. Un usuario del LDAP de Samba podría usar este fallo para bloquear samba Andrew Bartlett discovered that... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html • CWE-416: Use After Free •

CVE-2020-10700 – Ubuntu Security Notice USN-4341-1

https://notcve.org/view.php?id=CVE-2020-10700

28 Apr 2020 — A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2. Se encontró un fallo de uso de la memoria previamente liberada en el modo en que los servidores samba AD DC LDAP, manejaron el control de "Paged Results" que es combinado con el control "ASQ". Un usuario malic... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html • CWE-416: Use After Free •