CVE-2022-2031

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.(CVE-2022-32745)

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746)

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742)

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744)

As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC should only provide a ticket for kadmin/changepw but returns a krbtgt. So a user could skip the password change and just use the krbtgt to get service tickets and use services in the forest.(CVE-2022-2031)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746)

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742)

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744)

As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC should only provide a ticket for kadmin/changepw but returns a krbtgt. So a user could skip the password change and just use the krbtgt to get service tickets and use services in the forest.(CVE-2022-2031)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746)

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742)

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744)

As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC should only provide a ticket for kadmin/changepw but returns a krbtgt. So a user could skip the password change and just use the krbtgt to get service tickets and use services in the forest.(CVE-2022-2031)

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

• SECURITY UPDATE: disable kpasswd port to mitigate vulnerabilities
  • debian/patches/CVE-2022-2031_CVE-2022-32744.patch: add kpasswd port = 0 to disable kpasswd service as a workaround for CVE-2022-32744 and CVE-2022-2031
  • kpasswd is not a critical protocol for AD DC in most installations
  • CVE-2022-32744, CVE-2022-2031

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

Fixed AD restrictions bypass associated with changing passwords (bsc#1201495). (CVE-2022-2031) Fixed a memory leak in SMB1 (bsc#1201496). (CVE-2022-32742) Fixed an arbitrary password change request for any AD user (bsc#1201493). (CVE-2022-32744) Fixed a remote server crash with an LDAP add or modify request (bsc#1201492) (CVE-2022-32745) Fixed a use-after-free occurring in database audit logging (bsc#1201490). (CVE-2022-32746)

These are all security issues fixed in the ctdb-4.16.4+git.297.1497eb221ed-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following non-security bugs were fixed:

• netgroups support removed; (bso#15087); (bsc#1199247).
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734).
• smbclient commands del and deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).
• move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);

This update for ldb, samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following security bugs were fixed:

samba was updated to 4.15.8:

• Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042);
• Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099);
• Add support for bind 9.18; (bso#14986);
• logging dsdb audit to specific files does not work; (bso#15076);
• vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069);
• netgroups support removed; (bso#15087); (bsc#1199247);
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556);
• vfs_gpfs recalls=no option prevents listing files; (bso#15055);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
• ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108);
• smbd doesn't handle UPNs for looking up names; (bso#15054);
• Out-by-4 error in smbd read reply max_send clamp; (bso#14443);

• Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);
• Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);
• Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).

ldb was updated to version 2.4.3

• Fix build problems, waf produces incorrect names for python extensions; (bso#15071);

This update for ldb, samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following security bugs were fixed:

samba was updated to 4.15.8:

• Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042);
• Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099);
• Add support for bind 9.18; (bso#14986);
• logging dsdb audit to specific files does not work; (bso#15076);
• vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069);
• netgroups support removed; (bso#15087); (bsc#1199247);
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556);
• vfs_gpfs recalls=no option prevents listing files; (bso#15055);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
• ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108);
• smbd doesn't handle UPNs for looking up names; (bso#15054);
• Out-by-4 error in smbd read reply max_send clamp; (bso#14443);

• Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);
• Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);
• Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).

ldb was updated to version 2.4.3

• Fix build problems, waf produces incorrect names for python extensions; (bso#15071);

This update for ldb, samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following non-security bug were fixed:

ldb was updated to version 2.4.3:

• Fix build problems, waf produces incorrect names for python extensions; (bso#15071);

samba was updated to 4.15.8:

• Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042);
• Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099);
• Add support for bind 9.18; (bso#14986);
• logging dsdb audit to specific files does not work; (bso#15076);
• vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069);
• netgroups support removed; (bso#15087); (bsc#1199247);
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556);
• vfs_gpfs recalls=no option prevents listing files; (bso#15055);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
• ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108);
• smbd doesn't handle UPNs for looking up names; (bso#15054);
• Out-by-4 error in smbd read reply max_send clamp; (bso#14443);

• Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);
• Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);
• Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).

This update for samba fixes the following issues:

Version update to 4.15.12.

Security issues fixed:

• CVE-2022-2031: Fixed AD users that could have bypassed certain restrictions associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed SMB1 code that does not correctly verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths (bsc#1201496).
• CVE-2022-32744: Fixed AD users that could have forged password change requests for any user (bsc#1201493).
• CVE-2022-32745: Fixed AD users that could have crashed the server process with an LDAP add or modify request (bsc#1201492).
• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-3437: Fixed buffer overflow in Heimdal unwrap_des3() (bsc#1204254).
• CVE-2022-42898: Fixed Samba buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).

Bug fixes:

• Install a systemd drop-in file for named service to allow read/write access to the DLZ directory (bsc#1201689).
• Possible use after free of connection_struct when iterating smbd_server_connection->connections (bsc#1200102).

This update for samba fixes the following issues:

• Updated to version 4.15.13:
  • CVE-2022-38023: Removed weak cryptographic algorithms from the Netlogon RPC implementation (bsc#1206504).
  • CVE-2022-42898: Fixed several buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).
  • CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3() (bsc#1204254).
  • CVE-2022-32742: Fixed an information disclosure issue affecting SMB1 servers (bsc#1201496).
  • CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
  • CVE-2022-2031: Fixed an AD restriction bypass associated with changing passwords (bsc#1201495).
  • CVE-2022-32745: Fixed a remote server crash that could be triggered with certain LDAP requests (bsc#1201492).
  • CVE-2022-32744: Fixed an issue where AD users could have forged password change requests on behalf of other users (bsc#1201493).

Other fixes:

• Fixed a potential crash due to a concurrency issue (bsc#1200102).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).

• Updated to version 4.15.13:

  • CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).
  • CVE-2022-37967: Fixed a potential privilege escalation issue via constrained delegation due to weak a cryptographic algorithm being selected (bsc#1205386).
  • CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).

• Updated to version 4.15.12:

  • CVE-2022-42898: Fixed several buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).

• Updated to version 4.15.11:

  • CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3() (bsc#1204254).

• Updated to version 4.15.10:

  • Fixed a potential crash due to a concurrency issue (bsc#1200102).

• Updated to version 4.15.9:

  • CVE-2022-32742: Fixed an information leak that could be triggered via SMB1 (bsc#1201496).
  • CVE-2022-32746: Fixed a memory corruption issue in database audit logging (bsc#1201490).
  • CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
  • CVE-2022-32745: Fixed a remote server crash that could be triggered with certain LDAP requests (bsc#1201492).
  • CVE-2022-32744: Fixed an issue where AD users could have forged password change requests on behalf of other users (bsc#1201493).

Other fixes:

• Fixed a problem when using bind as samba-ad-dc backend related to the named service (bsc#1201689).

It was discovered that Samba did not handle MaxQueryDuration when being used in AD DC configurations, contrary to expectations. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3670)

Luke Howard discovered that Samba incorrectly handled certain restrictions associated with changing passwords. A remote attacker being requested to change passwords could possibly use this issue to escalate privileges. (CVE-2022-2031)

Luca Moro discovered that Samba incorrectly handled certain SMB1 communications. A remote attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2022-32742)

Joseph Sutton discovered that Samba incorrectly handled certain password change requests. A remote attacker could use this issue to change passwords of other users, resulting in privilege escalation. (CVE-2022-32744)

Joseph Sutton discovered that Samba incorrectly handled certain LDAP add or modify requests. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-32745)

Joseph Sutton and Andrew Bartlett discovered that Samba incorrectly handled certain LDAP add or modify requests. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-32746)