Samba vulnerabilities

A vulnerability in Samba Active Directory Domain Controller (AD DC) combines LDAP filter injection with improper authorization checks, allowing an authenticated low-privilege domain user to disclose confidential AD attributes such as msKds-RootKeyData, potentially leading to privilege escalation and full domain compromise.

Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.

In Samba library versions 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5, a vulnerability allows man-in-the-middle attackers to bypass a client-signing protection mechanism. This enables spoofing of SMB2 and SMB3 servers.

Samba versions 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 do not verify X.509 certificates from TLS servers, allowing man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.

The samldb_check_user_account_control_acl function in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during the creation of machine accounts. This allows remote authenticated users to bypass intended access restrictions.

In Samba versions 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, a vulnerability allows remote attackers to bypass intended file-access restrictions via a symlink pointing outside of a share when certain substring relationships in share names exist.

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, allowing remote attackers to execute arbitrary code via crafted Netlogon packets.

Samba versions 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allow remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, consequently gaining privileges.

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

A flaw in Samba allows remote command execution due to improper escaping of shell meta-characters in the 'check password script' feature when using the %u substitution. This affects non-standard configurations with samba-dcerpcd running as a system service.

The Samba printing subsystem contains a vulnerability where the client-controlled job description string is passed to the command configured with the 'print command' setting via the '%J' substitution character without escaping shell meta characters. A remote attacker can send a specially crafted print job description containing unescaped shell characters, leading to remote code execution.

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller's wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

Use-after-free vulnerability in Samba 4.x before version 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.

Samba has a buffer overflow which allows a remote attacker to obtain root access by specifying a long password.

In Samba's Kerberos KDC password change (kpasswd) service, an out-of-bounds read flaw exists. When processing malformed ASN.1-encoded requests, the server miscalculates structure size and attempts to read up to six bytes beyond the allocated buffer, potentially causing the KDC process to crash and resulting in denial of service.

A flaw in Samba's internal DNS server allows unauthenticated TKEY registration requests to be added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can send a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries.

A flaw in Samba's pam_winbind, when mkhomedir is enabled, fails to validate the home directory path before chowning it. This allows a non-root user with narrow sudo delegation to change ownership of the root directory (/), causing severe denial of service (SSH, sudo, and package-manager failures) without granting write access.

In Samba's WINS server component when running as an Active Directory Domain Controller, protocol handlers for certain request types do not properly validate incoming packets. An unauthenticated remote attacker can send specially crafted UDP packets, triggering a NULL pointer dereference and crashing the WINS service.

A flaw in Samba's vfs_worm module allows bypassing WORM (write-once, read-many) protections during file rename operations. An authenticated user with write access to a share can overwrite a protected file by renaming a newly created file over an existing WORM-protected file.

A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports.

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification.

A flaw was found in Samba's vfs_streams_xattr module where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.

A flaw in Samba causes the smbd daemon to ignore group membership changes when re-authenticating an expired SMB session. This can expose file shares until clients disconnect and reconnect.

A vulnerability was found in Samba's SMB2 packet signing mechanism. SMB2 packet signing is not enforced if an admin configured 'server signing = required' or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory.

CVE-2023-34968 is a path disclosure vulnerability in Samba that allows the server-side absolute path of shares, files, and directories to be disclosed in search query results. An attacker can exploit this flaw to view information contained in the disclosed path.

Samba 1.9.18 inadvertently includes a prototype application, wsmbconf, which is installed with incorrect permissions, including the setgid bit.