Summary
Orange Tsai discovered that the Samba vfs_fruit module incorrectly handled
certain memory operations. A remote attacker could use this issue to cause
Samba to crash, resulting in a denial of service, or possibly execute
arbitrary code as root. (CVE-2021-44142)
Michael Hanselmann discovered that Samba incorrectly created directories.
In certain configurations, a remote attacker could possibly create a
directory on the server outside of the shared directory. (CVE-2021-43566)
Kees van Vloten discovered that Samba incorrectly handled certain aliased
SPN checks. A remote attacker could possibly use this issue to impersonate
services. (CVE-2022-0336)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | samba | 2:4.13.17~dfsg-0ubuntu0.21.04.1 |
Vulnerabilities 3
-
High 8.8
The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple S…
-
Unscored —
All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a direct…
-
Unscored —
The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not al…