Permissions, Privileges, and Access Controls in Microsoft Windows and Windows Server - CVE-2022-37967

Vulnerability identifier: #VU69104

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-37967

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote administrator to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Kerberos, which leads to security restrictions bypass and privilege escalation.

Microsoft Windows
Windows Server
Amazon Linux AMI
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Slackware Linux
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
openSUSE Leap
Ubuntu
Fedora
IBM Observability with Instana
Samba
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
krb5 (Red Hat package)
samba (Ubuntu package)
samba
samba-ceph-debuginfo
samba-python3-debuginfo
samba-ceph
samba-ad-dc-libs-32bit-debuginfo
samba-ad-dc-libs-32bit
samba-winbind-libs-debuginfo
samba-winbind-libs
samba-winbind-debuginfo
samba-winbind
samba-tool
samba-client-32bit-debuginfo
samba-client-32bit
samba-client-libs-32bit
samba-client-libs-32bit-debuginfo
samba-devel-32bit
samba-libs-32bit
samba-libs-32bit-debuginfo
samba-winbind-libs-32bit
samba-winbind-libs-32bit-debuginfo
ctdb
ctdb-debuginfo
samba-libs-python3-debuginfo
samba-client-libs
samba-client-libs-debuginfo
samba-debuginfo
samba-debugsource
libsamba-policy-devel
libsamba-policy-python3-devel
libsamba-policy0-python3
libsamba-policy0-python3-debuginfo
samba-ad-dc
samba-ad-dc-debuginfo
samba-ad-dc-libs
samba-ad-dc-libs-debuginfo
samba-python3
samba-client
samba-libs-python3
samba-libs-debuginfo
samba-libs
samba-ldb-ldap-debuginfo
samba-ldb-ldap
samba-gpupdate
samba-dsdb-modules-debuginfo
samba-dsdb-modules
samba-devel
samba-client-debuginfo
libsamba-policy0-python3-32bit-debuginfo
libsamba-policy0-python3-32bit
samba-test-debuginfo
samba-test
samba-libs-python3-32bit
samba-libs-python3-32bit-debuginfo
samba-doc
ctdb-pcp-pmda
ctdb-pcp-pmda-debuginfo
net-fs/samba
HP-UX Common Internet File System (CIFS)

Install updates from vendor's website.

IBM Observability with Instana - update to 1.0.297
Samba - addressed in versions 4.15.13, 4.16.8, 4.17.4
HP-UX Common Internet File System (CIFS) - update to B.04.18.01.00
krb5 (Red Hat package) - addressed in versions 1.18.2-16.el8_6, 1.20.1-8.el9
samba (Ubuntu package) - addressed in versions 2:4.13.17~dfsg-0ubuntu1.20.04.4, 2:4.13.17~dfsg-0ubuntu1.20.04.5, 2:4.15.13+dfsg-0ubuntu0.20.04.1, 2:4.15.13+dfsg-0ubuntu1, 2:4.16.8+dfsg-0ubuntu1
samba - update to 4.15.13
samba-ceph-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-python3-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ceph - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ad-dc-libs-32bit-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ad-dc-libs-32bit - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-winbind-libs-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-winbind-libs - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-winbind-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-winbind - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-tool - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client-32bit-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client-32bit - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client-libs-32bit - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client-libs-32bit-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-devel-32bit - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs-32bit - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs-32bit-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-winbind-libs-32bit - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-winbind-libs-32bit-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
ctdb - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
ctdb-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs-python3-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client-libs - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client-libs-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-debugsource - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
libsamba-policy-devel - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
libsamba-policy-python3-devel - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
libsamba-policy0-python3 - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
libsamba-policy0-python3-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ad-dc - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ad-dc-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ad-dc-libs - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ad-dc-libs-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-python3 - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs-python3 - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ldb-ldap-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-ldb-ldap - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-gpupdate - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-dsdb-modules-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-dsdb-modules - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-devel - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-client-debuginfo - addressed in versions 4.15.13+git.540.fab3b2a46c6-150300.3.46.1, 4.15.13+git.591.ab36624310c-150400.3.19.1
libsamba-policy0-python3-32bit-debuginfo - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
libsamba-policy0-python3-32bit - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-test-debuginfo - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-test - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs-python3-32bit - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-libs-python3-32bit-debuginfo - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
samba-doc - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
ctdb-pcp-pmda - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
ctdb-pcp-pmda-debuginfo - update to 4.15.13+git.591.ab36624310c-150400.3.19.1
samba - addressed in versions 4.16.8-0.fc36, 4.17.4-0.fc37
samba - update to 4.17.5-0
net-fs/samba - update to 4.18.4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37967

• Multiple vulnerabilities in Microsoft Windows Kerberos
• Multiple vulnerabilities in Samba
• Slackware Linux update for samba
• SUSE update for samba
• Ubuntu update for samba
• SUSE update for samba
• Ubuntu update for samba
• Ubuntu update for samba
• Red Hat Enterprise Linux 9 update for krb5
• Gentoo update for Samba
• Red Hat Enterprise Linux 8.6 Extended Update Support update for krb5
• Amazon Linux AMI update for samba
• Fedora 37 update for samba
• Fedora 36 update for samba
• Multiple vulnerabilities in HP-UX Common Internet File System (CIFS)
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)