SB2024080686 - Amazon Linux AMI update for samba
Published: August 6, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 secuirty vulnerabilities.
1) Improper access control (CVE-ID: CVE-2016-2124)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to SMB1 client connections can be downgraded to plaintext authentication. A remote attacker can perform a man-in-the-middle attack and downgrade a negotiated SMB1 client connection and its capabitilities.
2) Security Features (CVE-ID: CVE-2020-17049)
The vulnerability allows a remote user to bypass authentication process.
The vulnerability exists due to security feature bypass issue in Kerberos. A remote administrator can bypass authentication process and gain unauthorized access to the application.
3) Race condition (CVE-ID: CVE-2021-20316)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to a race condition. A remote user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
4) Link following (CVE-ID: CVE-2021-43566)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to a symlink race condition when creating directories. A remote authenticated user can use SMB1 or NFS symlink race to create directories on the Unix filesystem outside of the share definition.
Successful exploitation of the vulnerability requites that the user has permissions to create folder in the target directory.
5) Link following (CVE-ID: CVE-2021-44141)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to insecure link following. A remote user with ability to write files to the exported part of the file system under a share via SMB1 unix extensions or via NFS can create a symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition.
6) Insufficient verification of data authenticity (CVE-ID: CVE-2022-0336)
The vulnerability allows a local user to impersonate arbitrary services.
The vulnerability exists due to Samba AD DC relies only on SPN (service principals name) to identify services on the network. An attacker with ability to modify SPNs can bypass implemented protection and cause a denial of service condition by adding an SPN that matches an existing service or impersonate services on the network.
7) Use of insufficiently random values (CVE-ID: CVE-2022-1615)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to usage of predictable random values within the GnuTLS gnutls_rnd() function. A remote user can decrypt sensitive information.
8) Memory leak (CVE-ID: CVE-2022-32742)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due memory leak when handling SMB1 requests. A remote user with ability to write data to a file share can force the application to leak memory and gain access to potentially sensitive information.
9) Incorrect default permissions (CVE-ID: CVE-2022-32743)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to Samba does not validate the Validated-DNS-Host-Name for the dNSHostName attribute. A remote attacker can set an arbitrary hostname and perform MitM attack.
10) Use-after-free (CVE-ID: CVE-2022-32746)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error when handling LDAP requests. A remote user with ability to edit privileged properties, such as userAccountControl, can send a specially crafted LDAP request to the server, trigger a use-after-free error and perform a denial of service (DoS) attack.
11) Heap-based buffer overflow (CVE-ID: CVE-2022-3437)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. A remote user can send specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.
12) UNIX symbolic link following (CVE-ID: CVE-2022-3592)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to a symlink following issue. A remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS can create symlinks to files outside of the smbd configured share path and access otherwise restricted files on the server.
13) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-37966)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Kerberos RC4-HMAC. A remote attacker can conduct a man-in-middle (MiTM) attack, which leads to security restrictions bypass and privilege escalation.
14) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-37967)
The vulnerability allows a remote administrator to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Kerberos, which leads to security restrictions bypass and privilege escalation.
15) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2022-38023)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to security features bypass in Netlogon RPC. A remote attacker can bypass the Netlogon cryptography feature for signing and sealing traffic during Netlogon authentication.
16) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2022-45141)
The vulnerability allows a remote attacker to bypass authentication.
The
vulnerability exists due to an error that allows an attacker to force
the server so issue an rc4-hmac ticket encrypted tickets despite the
target server supporting better encryption (eg aes256-cts-hmac-sha1-96).
A remote attacker can perform an offline attack against the ticket
encrypted with rc4-hmac and login as a privileged user.
Remediation
Install update from vendor's website.