92 results · Feed
-
High 7.5
Samba: denial of service against ad dc wins server
A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a …
-
Critical 9.0
Samba: remote code execution in samr
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controll…
-
High 7.1
Samba: missing access check on reparse point operations
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata t…
-
Medium 6.5
Samba: vfs_worm does not block directory modification
A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenti…
-
High 8.0
Samba: group policy certificate enrollment uses http:// without validation
A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verifi…
-
Critical 9.0
Samba: samba: remote code execution in printing subsystem via unescaped job description
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacke…
-
Critical 10.0
Samba: command injection in wins server hook script
A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command…
-
Medium 4.3
Samba: vfs_streams_xattr uninitialized memory write possible
A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an inform…
-
Medium 4.9
Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
-
High 7.5
Samba: ad dc password exposure to privileged users and rodcs
A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to acces…
-
Medium 6.5
Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" ser…
-
Critical 9.1
Samba: smbd allows client access to unix domain sockets on the file system as root
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR…
-
Medium 6.5
Samba: ad dc busy rpc multiple listener dos
A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non…
-
Medium 6.5
Samba: smb clients can truncate files with read-only permissions
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files …
-
Medium 4.3
A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged us…
-
Critical 9.8
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and p…
-
Unscored —
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authe…
-
Medium 4.3
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines…
-
Medium 6.5
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' esc…
-
High 8.8
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to …
-
High 8.1
Netlogon RPC Elevation of Privilege Vulnerability
Netlogon RPC Elevation of Privilege Vulnerability
-
High 7.2
Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
-
High 8.1
Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
-
Unscored —
In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.
-
Unscored —
Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged…
-
Unscored —
The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not al…
-
Unscored —
A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kp…
-
Medium 4.3
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enou…
-
Unscored —
A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify …
-
Unscored —
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values fr…
-
Unscored —
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account an…
-
Unscored —
MaxQueryDuration not honoured in Samba AD DC LDAP
-
Unscored —
Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for L…
-
Unscored —
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanis…
-
Unscored —
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request,…
-
High 8.8
The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple S…
-
Unscored —
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a fil…
-
Unscored —
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only doma…
-
Unscored —
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentica…
-
Unscored —
Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacke…