// For flags

CVE-2022-32742

Samba SMB1 Out-Of-Bounds Read Information Disclosure Vulnerability

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).

Se ha encontrado un fallo en Samba. Algunas solicitudes de escritura de SMB1 no son comprobaban correctamente para asegurar que el cliente había enviado suficientes datos para completar la escritura, lo que permitía que el contenido de la memoria del servidor fuera escrita en el archivo (o impresora) en lugar de los datos proporcionados por el cliente. El cliente no puede controlar el área de la memoria del servidor que es escrita en el archivo (o impresora).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Samba. Authentication is required to exploit this vulnerability, and SMB1 must be enabled on the target.
The specific flaw exists within the Samba service, which listens on TCP port 139 by default. A crafted SMB1 command can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to disclose information in the context of the Samba service process or to create a denial-of-service condition on the system.

*Credits: Luca Moro (@johncool__)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2022-06-09 CVE Reserved
  • 2022-08-01 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-11-01 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Samba
Search vendor "Samba"
 Samba
Search vendor "Samba" for product "Samba"
 < 4.14.14
Search vendor "Samba" for product "Samba" and version " < 4.14.14"
-
Affected
Samba
Search vendor "Samba"
 Samba
Search vendor "Samba" for product "Samba"
 >= 4.15.0 < 4.15.9
Search vendor "Samba" for product "Samba" and version " >= 4.15.0 < 4.15.9"
-
Affected
Samba
Search vendor "Samba"
 Samba
Search vendor "Samba" for product "Samba"
 >= 4.16.0 < 4.16.4
Search vendor "Samba" for product "Samba" and version " >= 4.16.0 < 4.16.4"
-
Affected