SB2022121537 - Multiple vulnerabilities in Samba

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2022-45141)

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to an error that allows an attacker to force the server so issue an rc4-hmac ticket encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96). A remote attacker can perform an offline attack against the ticket encrypted with rc4-hmac and login as a privileged user.

2) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2022-38023)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to security features bypass in Netlogon RPC. A remote attacker can bypass the Netlogon cryptography feature for signing and sealing traffic during Netlogon authentication.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-37967)

The vulnerability allows a remote administrator to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Kerberos, which leads to security restrictions bypass and privilege escalation.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-37966)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Kerberos RC4-HMAC. A remote attacker can conduct a man-in-middle (MiTM) attack, which leads to security restrictions bypass and privilege escalation.

Remediation

Install update from vendor's website.

References

• https://www.samba.org/samba/security/CVE-2022-45141.html
• https://www.samba.org/samba/security/CVE-2022-38023.html
• https://www.samba.org/samba/security/CVE-2022-37967.html
• https://www.samba.org/samba/security/CVE-2022-37966.html