Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34968: Spotlight server-side Share Path Disclosure NOTE: https://www.samba.org/samba/security/CVE-2023-34968.html CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability NOTE: https://www.samba.org/samba/security/CVE-2023-34967.html CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability NOTE: https://www.samba.org/samba/security/CVE-2023-34966.html CVE-2023-3347: SMB2 packet signing not enforced NOTE: https://www.samba.org/samba/security/CVE-2023-3347.html CVE-2022-2127: When doing NTLM authentication, the client sends replies to cryptographic challenges back to the server. These replies have variable length. Winbind did not properly bounds-check the lan manager response length, which despite the lan manager version no longer being used is still part of the protocol. If the system is running Samba's ntlm_auth as authentication backend for services like Squid (or a very unusual configuration with FreeRADIUS), the vulnarebility is remotely exploitable If not so configured, or to exploit this vulnerability locally, the user must have access to the privileged winbindd UNIX domain socket (a subdirectory with name 'winbindd_privileged' under "state directory", as set in the smb.conf). This access is normally only given so special system services like Squid or FreeRADIUS, that use this feature.
Fixed packages 55
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libnetapi | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libnetapi-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libnetapi-devel | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libsmbclient | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libsmbclient-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libsmbclient-devel | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libwbclient | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libwbclient-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | libwbclient-devel | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-samba | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-samba-dc | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-samba-dc-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-samba-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-samba-devel | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-samba-test | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-client | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-client-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-client-libs | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-client-libs-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-common | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-common-libs | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-common-libs-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-common-tools | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-common-tools-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-dc-libs | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-dc-libs-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-dcerpc | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-dcerpc-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-debugsource | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-devel | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-krb5-printing | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-krb5-printing-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-ldb-ldap-modules | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-ldb-ldap-modules-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-libs | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-libs-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-pidl | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-test | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-test-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-test-libs | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-test-libs-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-tools | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-usershares | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-vfs-iouring | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-vfs-iouring-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind-clients | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind-clients-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind-krb5-locator | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind-krb5-locator-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind-modules | 2:4.17.10-0.amzn2023.0.1 |
| Amazon Linux · 2023 | samba-winbind-modules-debuginfo | 2:4.17.10-0.amzn2023.0.1 |
Vulnerabilities 5
-
High 7.5CVE-2023-34966 EPSS 62%
Samba: infinite loop in mdssvc rpc service for spotlight
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains t…
-
Medium 5.9
Samba: out-of-bounds read in winbind auth_crap
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, …
-
Medium 5.9
Samba: smb2 packet signing is not enforced when "server signing = required" is set
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allo…
-
Medium 5.3CVE-2023-34967 EPSS 61%
Samba: type confusion in mdssvc rpc service for spotlight
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the …
-
Medium 5.3
Samba: spotlight server-side share path disclosure
A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2127.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3347.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-34966.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-34967.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-34968.html