Permissions, Privileges, and Access Controls in Samba - CVE-2023-0225

Vulnerability identifier: #VU74178

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0225

CWE-ID: CWE-264

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to delete certain attributes.

The vulnerability exists due to improper access restrictions. A remote unprivileged user can delete the "dnsHostname" attribute.

Samba
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
Basesystem Module
openSUSE Leap
openEuler
Fedora
HP-UX Common Internet File System (CIFS)
libldb-devel
libldb2-debuginfo
ldb-tools-debuginfo
ldb-debugsource
python3-ldb-devel
ldb-tools
libldb2
libldb2-32bit
libldb2-32bit-debuginfo
python3-ldb
python3-ldb-debuginfo
python3-ldb-32bit
python3-ldb-32bit-debuginfo
libldb
samba-debuginfo
samba-ad-dc-libs-32bit
samba-client-32bit
samba-libs-32bit
samba-libs-32bit-debuginfo
samba-winbind-libs-32bit
samba-ad-dc
samba-ad-dc-debuginfo
samba-winbind-libs-debuginfo
samba-libs-debuginfo
samba-client-libs
samba-gpupdate
samba-client
libsamba-policy0-python3-debuginfo
samba-devel
samba-libs-python3-debuginfo
libsamba-policy-devel
samba-ceph
libsamba-policy0-python3
ctdb
ctdb-debuginfo
samba-debugsource
samba-dsdb-modules-debuginfo
samba
samba-libs-python3
samba-winbind-debuginfo
libsamba-policy-python3-devel
samba-ad-dc-libs-debuginfo
samba-python3
samba-client-debuginfo
samba-client-libs-32bit
samba-dsdb-modules
samba-python3-debuginfo
samba-ldb-ldap-debuginfo
samba-libs
samba-winbind
samba-client-libs-debuginfo
samba-tool
samba-client-32bit-debuginfo
samba-devel-32bit
samba-ceph-debuginfo
samba-winbind-libs
samba-ad-dc-libs-32bit-debuginfo
samba-winbind-libs-32bit-debuginfo
samba-ldb-ldap
samba-client-libs-32bit-debuginfo
samba-ad-dc-libs
ctdb-pcp-pmda
libsamba-policy0-python3-32bit-debuginfo
libsamba-policy0-python3-32bit
samba-libs-python3-32bit-debuginfo
samba-libs-python3-32bit
samba-doc
ctdb-pcp-pmda-debuginfo
samba-test
samba-test-debuginfo
samba-common-tools
samba-usershares
python3-samba-test
samba-help
libwbclient-devel
samba-common
samba-dc-provision
samba-dc-libs
samba-dc
libsmbclient
samba-winbind-clients
libwbclient
python3-samba-dc
samba-krb5-printing
python3-samba
samba-winbind-modules
libsmbclient-devel
samba-dc-bind-dlz
samba-winbind-krb5-locator
samba-pidl
samba-vfs-glusterfs
net-fs/samba

Install updates from vendor's website.

Samba - addressed in versions 4.17.7, 4.18.1
HP-UX Common Internet File System (CIFS) - update to B.04.18.01.00
libldb-devel - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
libldb2-debuginfo - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
ldb-tools-debuginfo - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
ldb-debugsource - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
python3-ldb-devel - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
ldb-tools - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
libldb2 - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
libldb2-32bit - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
libldb2-32bit-debuginfo - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
python3-ldb - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
python3-ldb-debuginfo - addressed in versions 2.4.4-150300.3.23.1, 2.4.4-150400.4.11.1
python3-ldb-32bit - update to 2.4.4-150400.4.11.1
python3-ldb-32bit-debuginfo - update to 2.4.4-150400.4.11.1
libldb - addressed in versions 2.6.2-1.fc37, 2.7.2-1.fc38, 2.7.2-1.fc39
samba-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ad-dc-libs-32bit - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client-32bit - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs-32bit - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs-32bit-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-winbind-libs-32bit - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ad-dc - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ad-dc-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-winbind-libs-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client-libs - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-gpupdate - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
libsamba-policy0-python3-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-devel - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs-python3-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
libsamba-policy-devel - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ceph - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
libsamba-policy0-python3 - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
ctdb - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
ctdb-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-debugsource - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-dsdb-modules-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs-python3 - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-winbind-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
libsamba-policy-python3-devel - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ad-dc-libs-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-python3 - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client-libs-32bit - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-dsdb-modules - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-python3-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ldb-ldap-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-winbind - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client-libs-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-tool - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client-32bit-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-devel-32bit - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ceph-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-winbind-libs - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ad-dc-libs-32bit-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-winbind-libs-32bit-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ldb-ldap - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-client-libs-32bit-debuginfo - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-ad-dc-libs - addressed in versions 4.15.13+git.636.53d93c5b9d6-150300.3.52.1, 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
ctdb-pcp-pmda - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
libsamba-policy0-python3-32bit-debuginfo - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
libsamba-policy0-python3-32bit - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs-python3-32bit-debuginfo - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-libs-python3-32bit - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-doc - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
ctdb-pcp-pmda-debuginfo - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-test - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-test-debuginfo - update to 4.15.13+git.636.53d93c5b9d6-150400.3.23.1
samba-common-tools - update to 4.17.5-4
samba-usershares - update to 4.17.5-4
python3-samba-test - update to 4.17.5-4
samba-help - update to 4.17.5-4
samba-devel - update to 4.17.5-4
libwbclient-devel - update to 4.17.5-4
samba-common - update to 4.17.5-4
samba-dc-provision - update to 4.17.5-4
samba-debuginfo - update to 4.17.5-4
samba-client - update to 4.17.5-4
samba-dc-libs - update to 4.17.5-4
samba-dc - update to 4.17.5-4
samba-libs - update to 4.17.5-4
samba-test - update to 4.17.5-4
libsmbclient - update to 4.17.5-4
samba-winbind-clients - update to 4.17.5-4
libwbclient - update to 4.17.5-4
python3-samba-dc - update to 4.17.5-4
samba-debugsource - update to 4.17.5-4
samba-krb5-printing - update to 4.17.5-4
python3-samba - update to 4.17.5-4
samba-winbind-modules - update to 4.17.5-4
libsmbclient-devel - update to 4.17.5-4
samba-client-libs - update to 4.17.5-4
samba-dc-bind-dlz - update to 4.17.5-4
ctdb - update to 4.17.5-4
samba-winbind-krb5-locator - update to 4.17.5-4
samba-winbind - update to 4.17.5-4
samba - update to 4.17.5-4
samba-pidl - update to 4.17.5-4
samba-vfs-glusterfs - update to 4.17.5-4
samba - addressed in versions 4.17.7-0.fc37, 4.18.1-0.fc38, 4.18.1-0.fc39
samba - update to 4.17.8-0
net-fs/samba - update to 4.18.4

• https://www.samba.org/samba/security/CVE-2023-0225.html

• Multiple vulnerabilities in Samba
• SUSE update for ldb, samba
• SUSE update for ldb, samba
• Fedora 39 update for libldb, samba
• Fedora 38 update for libldb, samba
• Fedora 37 update for libldb, samba
• Gentoo update for Samba
• openEuler 22.03 LTS SP1 update for samba
• Amazon Linux AMI update for samba
• Amazon Linux AMI update for samba
• Multiple vulnerabilities in HP-UX Common Internet File System (CIFS)