Incorrect default permissions in Samba - CVE-2022-32743

Vulnerability identifier: #VU67271

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-32743

CWE-ID: CWE-276

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Affected software:
Samba
Amazon Linux AMI
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
openEuler
Fedora
freeipa
python3-samba
samba
samba-common-tools
samba-debuginfo
samba-help
samba-client
samba-devel
python3-samba-dc
samba-winbind-krb5-locator
ctdb-tests
samba-krb5-printing
python3-samba-test
libwbclient
samba-libs
libwbclient-devel
samba-winbind-modules
samba-vfs-glusterfs
samba-pidl
samba-common
libsmbclient
samba-winbind
samba-dc
samba-test
samba-winbind-clients
libsmbclient-devel
ctdb
samba-debugsource
samba-dc-provision
samba-dc-bind-dlz
samba-dsdb-modules-debuginfo
samba-dsdb-modules
samba-client-debuginfo
samba-ad-dc-libs-debuginfo
samba-ad-dc-libs
samba-ad-dc-debuginfo
samba-ad-dc
libsamba-policy0-python3-debuginfo
libsamba-policy0-python3
libsamba-policy-python3-devel
libsamba-policy-devel
samba-ceph
ctdb-pcp-pmda-debuginfo
samba-gpupdate
samba-ldb-ldap
samba-ldb-ldap-debuginfo
samba-libs-debuginfo
samba-libs-python3
samba-libs-python3-debuginfo
samba-python3
samba-python3-debuginfo
samba-test-debuginfo
samba-tool
samba-winbind-debuginfo
samba-winbind-libs
samba-winbind-libs-debuginfo
ctdb-debuginfo
samba-doc
samba-winbind-libs-32bit-debuginfo
samba-winbind-libs-32bit
samba-libs-python3-32bit-debuginfo
samba-libs-python3-32bit
samba-libs-32bit-debuginfo
samba-libs-32bit
samba-devel-32bit
samba-client-libs-32bit-debuginfo
samba-client-libs-32bit
samba-client-32bit-debuginfo
samba-client-32bit
samba-ad-dc-libs-32bit-debuginfo
samba-ad-dc-libs-32bit
libsamba-policy0-python3-32bit-debuginfo
samba-libs-python3-64bit-debuginfo
ctdb-pcp-pmda
samba-client-libs-debuginfo
samba-client-libs
samba-ceph-debuginfo
libsamba-policy0-python3-64bit
libsamba-policy0-python3-64bit-debuginfo
samba-client-64bit
samba-client-64bit-debuginfo
samba-libs-64bit
samba-libs-64bit-debuginfo
samba-libs-python3-64bit
libsamba-policy0-python3-32bit
net-fs/samba

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to Samba does not validate the Validated-DNS-Host-Name for the dNSHostName attribute. A remote attacker can set an arbitrary hostname and perform MitM attack.

Install updates from vendor's website.

• https://bugzilla.samba.org/show_bug.cgi?id=14833
• https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5c578b15-d619-408d-ba17-380714b89fd1