Samba: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• Critical 9.1
  CVE-2023-3961

  Samba: smbd allows client access to unix domain sockets on the file system as root

  A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux Alpine
  Nov 3, 2023
• High 7.5
  CVE-2023-4154

  Samba: ad dc password exposure to privileged users and rodcs

  A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to acces…

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Nov 7, 2023
• Medium 6.5
  CVE-2023-4091

  Samba: smb clients can truncate files with read-only permissions

  A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 3, 2023
• Medium 6.5
  CVE-2023-42669

  Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc

  A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" ser…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 6, 2023
• Medium 6.5
  CVE-2023-42670

  Samba: ad dc busy rpc multiple listener dos

  A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 3, 2023

Revision history

1. 2025-04-09 #20

   Neue Updates von IBM aufgenommen

2. 2024-10-27 #19

   Neue Updates von HP aufgenommen

3. 2024-04-22 #18

   Neue Updates von Debian aufgenommen

4. 2024-04-11 #17

   Neue Updates von IBM aufgenommen

5. 2024-03-27 #16

   Neue Updates von IBM aufgenommen

6. 2024-03-24 #15

   Neue Updates von Debian aufgenommen

7. 2024-02-18 #14

   Neue Updates von Gentoo aufgenommen

8. 2023-12-10 #13

   Neue Updates von QNAP aufgenommen

9. 2023-12-05 #12

   Neue Updates von Amazon aufgenommen

10. 2023-12-04 #11

    Neue Updates von Amazon aufgenommen

11. 2023-11-27 #10

    Neue Updates von Oracle Linux aufgenommen

12. 2023-11-22 #9

    Neue Updates von Red Hat aufgenommen

13. 2023-11-21 #8

    Neue Updates von Red Hat aufgenommen

14. 2023-11-16 #7

    Neue Updates von Oracle Linux aufgenommen

15. 2023-11-07 #6

    Neue Updates von Red Hat aufgenommen

16. 2023-10-31 #5

    Neue Updates von Red Hat aufgenommen

17. 2023-10-17 #4

    Neue Updates von SUSE und Ubuntu aufgenommen

18. 2023-10-12 #3

    Neue Updates von SUSE aufgenommen

19. 2023-10-11 #2

    Neue Updates von Fedora, Ubuntu und Debian aufgenommen

20. 2023-10-10 #1

    Initiale Fassung

References

• Samba release notes 4.19.1 vom 2023-10-10
  https://www.samba.org/samba/history/samba-4.19.1.html
• Samba release notes 4.18.8 vom 2023-10-10
  https://www.samba.org/samba/history/samba-4.18.8.html
• Samba release notes 4.17.12 vom 2023-10-10
  https://www.samba.org/samba/history/samba-4.17.12.html
• Ubuntu Security Notice USN-6425-1 vom 2023-10-10
  https://ubuntu.com/security/notices/USN-6425-1
• SUSE Security Update SUSE-SU-2023:4040-1 vom 2023-10-10
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016619.html
• SUSE Security Update SUSE-SU-2023:4046-1 vom 2023-10-11
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016626.html
• Fedora Security Advisory FEDORA-2023-99444E494B vom 2023-10-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-99444e494b
• Ubuntu Security Notice USN-6425-2 vom 2023-10-11
  https://ubuntu.com/security/notices/USN-6425-2
• Debian Security Advisory DSA-5525 vom 2023-10-12
  https://www.debian.org/security/2023/dsa-5525
• Fedora Security Advisory FEDORA-2023-FFF0C857D6 vom 2023-10-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-fff0c857d6
• Fedora Security Advisory FEDORA-2023-7EB8CBF1A5 vom 2023-10-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-7eb8cbf1a5
• SUSE Security Update SUSE-SU-2023:4059-1 vom 2023-10-13
  https://www.suse.com/support/update/announcement/2023/suse-su-20234059-1/
• SUSE Security Update SUSE-SU-2023:4096-1 vom 2023-10-17
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016714.html
• Ubuntu Security Notice USN-6425-3 vom 2023-10-17
  https://ubuntu.com/security/notices/USN-6425-3
• Red Hat Security Advisory RHSA-2023:6209 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6209
• Red Hat Security Advisory RHSA-2023:6744 vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6744
• Oracle Linux Security Advisory ELSA-2023-6744 vom 2023-11-16
  https://linux.oracle.com/errata/ELSA-2023-6744.html
• Red Hat Security Advisory RHSA-2023:7408 vom 2023-11-21
  https://access.redhat.com/errata/RHSA-2023:7408
• Red Hat Security Advisory RHSA-2023:7371 vom 2023-11-21
  https://access.redhat.com/errata/RHSA-2023:7371
• Red Hat Security Advisory RHSA-2023:7464 vom 2023-11-23
  https://access.redhat.com/errata/RHSA-2023:7464
• Red Hat Security Advisory RHSA-2023:7467 vom 2023-11-23
  https://access.redhat.com/errata/RHSA-2023:7467
• Oracle Linux Security Advisory ELSA-2023-7467 vom 2023-11-27
  https://linux.oracle.com/errata/ELSA-2023-7467.html
• Amazon Linux Security Advisory ALAS-2023-2367 vom 2023-12-05
  https://alas.aws.amazon.com/AL2/ALAS-2023-2367.html
• Amazon Linux Security Advisory ALAS-2023-1896 vom 2023-12-05
  https://www.cybersecurity-help.cz/vdb/SB2023120539
• QNAP Security Advisory QSA-23-20 vom 2023-12-08
  https://www.qnap.com/de-de/security-advisory/QSA-23-20
• Gentoo Linux Security Advisory GLSA-202402-28 vom 2024-02-19
  https://security.gentoo.org/glsa/202402-28
• Debian Security Advisory DSA-5647 vom 2024-03-24
  https://lists.debian.org/debian-security-announce/2024/msg00055.html
• IBM Security Bulletin 7145367 vom 2024-03-27
  https://www.ibm.com/support/pages/node/7145367
• IBM Security Bulletin 7148094 vom 2024-04-11
  https://www.ibm.com/support/pages/node/7148094
• Debian Security Advisory DLA-3792 vom 2024-04-22
  https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html
• HPE Security Bulletin vom 2024-10-25
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04724en_us&docLocale=en_US
• IBM Security Bulletin 7230557 vom 2025-04-10
  https://www.ibm.com/support/pages/node/7230557