Moderate: samba security update (Oracle Linux 9)

Summary

Fixed packages 33

Vulnerabilities 3

• Critical 9.1
  CVE-2023-3961

  Samba: smbd allows client access to unix domain sockets on the file system as root

  A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux Alpine
  Nov 3, 2023
• Medium 6.5
  CVE-2023-4091

  Samba: smb clients can truncate files with read-only permissions

  A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 3, 2023
• Medium 6.5
  CVE-2023-42669

  Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc

  A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" ser…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 6, 2023