CVE-2022-32746

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.(CVE-2022-32745)

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746)

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742)

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744)

As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC should only provide a ticket for kadmin/changepw but returns a krbtgt. So a user could skip the password change and just use the krbtgt to get service tickets and use services in the forest.(CVE-2022-2031)

An extensible library that implements an LDAP like API to access remote LDAP servers, or use local tdb databases.

Security Fix(es):

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746)

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742)

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744)

As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC should only provide a ticket for kadmin/changepw but returns a krbtgt. So a user could skip the password change and just use the krbtgt to get service tickets and use services in the forest.(CVE-2022-2031)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.(CVE-2022-32746)

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742)

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744)

As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC should only provide a ticket for kadmin/changepw but returns a krbtgt. So a user could skip the password change and just use the krbtgt to get service tickets and use services in the forest.(CVE-2022-2031)

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases.

The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077484)

Security Fix(es):

• samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases.

The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077490)

Security Fix(es):

• samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases.

The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077484)

Security Fix(es):

• samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases.

The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077490)

Security Fix(es):

• samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

Fixed AD restrictions bypass associated with changing passwords (bsc#1201495). (CVE-2022-2031) Fixed a memory leak in SMB1 (bsc#1201496). (CVE-2022-32742) Fixed an arbitrary password change request for any AD user (bsc#1201493). (CVE-2022-32744) Fixed a remote server crash with an LDAP add or modify request (bsc#1201492) (CVE-2022-32745) Fixed a use-after-free occurring in database audit logging (bsc#1201490). (CVE-2022-32746)

These are all security issues fixed in the ldb-tools-2.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ctdb-4.16.4+git.297.1497eb221ed-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following non-security bugs were fixed:

• netgroups support removed; (bso#15087); (bsc#1199247).
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734).
• smbclient commands del and deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).
• move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);

This update for ldb, samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following security bugs were fixed:

samba was updated to 4.15.8:

• Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042);
• Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099);
• Add support for bind 9.18; (bso#14986);
• logging dsdb audit to specific files does not work; (bso#15076);
• vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069);
• netgroups support removed; (bso#15087); (bsc#1199247);
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556);
• vfs_gpfs recalls=no option prevents listing files; (bso#15055);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
• ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108);
• smbd doesn't handle UPNs for looking up names; (bso#15054);
• Out-by-4 error in smbd read reply max_send clamp; (bso#14443);

• Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);
• Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);
• Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).

ldb was updated to version 2.4.3

• Fix build problems, waf produces incorrect names for python extensions; (bso#15071);

This update for ldb, samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following security bugs were fixed:

samba was updated to 4.15.8:

• Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042);
• Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099);
• Add support for bind 9.18; (bso#14986);
• logging dsdb audit to specific files does not work; (bso#15076);
• vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069);
• netgroups support removed; (bso#15087); (bsc#1199247);
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556);
• vfs_gpfs recalls=no option prevents listing files; (bso#15055);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
• ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108);
• smbd doesn't handle UPNs for looking up names; (bso#15054);
• Out-by-4 error in smbd read reply max_send clamp; (bso#14443);

• Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);
• Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);
• Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).

ldb was updated to version 2.4.3

• Fix build problems, waf produces incorrect names for python extensions; (bso#15071);

This update for ldb, samba fixes the following issues:

• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
• CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
• CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).

The following non-security bug were fixed:

ldb was updated to version 2.4.3:

• Fix build problems, waf produces incorrect names for python extensions; (bso#15071);

samba was updated to 4.15.8:

• Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042);
• Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099);
• Add support for bind 9.18; (bso#14986);
• logging dsdb audit to specific files does not work; (bso#15076);
• vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069);
• netgroups support removed; (bso#15087); (bsc#1199247);
• net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556);
• vfs_gpfs recalls=no option prevents listing files; (bso#15055);
• waf produces incorrect names for python extensions with Python 3.11; (bso#15071);
• Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
• ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108);
• smbd doesn't handle UPNs for looking up names; (bso#15054);
• Out-by-4 error in smbd read reply max_send clamp; (bso#14443);

• Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255);
• Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);
• Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).

This update for samba fixes the following issues:

Version update to 4.15.12.

Security issues fixed:

• CVE-2022-2031: Fixed AD users that could have bypassed certain restrictions associated with changing passwords (bsc#1201495).
• CVE-2022-32742: Fixed SMB1 code that does not correctly verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths (bsc#1201496).
• CVE-2022-32744: Fixed AD users that could have forged password change requests for any user (bsc#1201493).
• CVE-2022-32745: Fixed AD users that could have crashed the server process with an LDAP add or modify request (bsc#1201492).
• CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
• CVE-2022-3437: Fixed buffer overflow in Heimdal unwrap_des3() (bsc#1204254).
• CVE-2022-42898: Fixed Samba buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).

Bug fixes:

• Install a systemd drop-in file for named service to allow read/write access to the DLZ directory (bsc#1201689).
• Possible use after free of connection_struct when iterating smbd_server_connection->connections (bsc#1200102).

This update for samba fixes the following issues:

• Updated to version 4.15.13:
  • CVE-2022-38023: Removed weak cryptographic algorithms from the Netlogon RPC implementation (bsc#1206504).
  • CVE-2022-42898: Fixed several buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).
  • CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3() (bsc#1204254).
  • CVE-2022-32742: Fixed an information disclosure issue affecting SMB1 servers (bsc#1201496).
  • CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
  • CVE-2022-2031: Fixed an AD restriction bypass associated with changing passwords (bsc#1201495).
  • CVE-2022-32745: Fixed a remote server crash that could be triggered with certain LDAP requests (bsc#1201492).
  • CVE-2022-32744: Fixed an issue where AD users could have forged password change requests on behalf of other users (bsc#1201493).

Other fixes:

• Fixed a potential crash due to a concurrency issue (bsc#1200102).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).

• Updated to version 4.15.13:

  • CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).
  • CVE-2022-37967: Fixed a potential privilege escalation issue via constrained delegation due to weak a cryptographic algorithm being selected (bsc#1205386).
  • CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).

• Updated to version 4.15.12:

  • CVE-2022-42898: Fixed several buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).

• Updated to version 4.15.11:

  • CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3() (bsc#1204254).

• Updated to version 4.15.10:

  • Fixed a potential crash due to a concurrency issue (bsc#1200102).

• Updated to version 4.15.9:

  • CVE-2022-32742: Fixed an information leak that could be triggered via SMB1 (bsc#1201496).
  • CVE-2022-32746: Fixed a memory corruption issue in database audit logging (bsc#1201490).
  • CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
  • CVE-2022-32745: Fixed a remote server crash that could be triggered with certain LDAP requests (bsc#1201492).
  • CVE-2022-32744: Fixed an issue where AD users could have forged password change requests on behalf of other users (bsc#1201493).

Other fixes:

• Fixed a problem when using bind as samba-ad-dc backend related to the named service (bsc#1201689).

This update for ldb, samba fixes the following issues:

ldb:

• CVE-2022-32746: Fixed an use-after-free issue in the database audit logging module (bsc#1201490).
• CVE-2023-0614: Fixed discovering of access controlled AD LDAP attributes (bso#15270) (bsc#1209485).

samba:

• CVE-2023-0922: Fixed cleartext password sending by AD DC admin tool (bso#15315) (bsc#1209481).
• CVE-2023-0225: Fixed deletion of AD DC 'dnsHostname' attribute by unprivileged authenticated users (bso#15276) (bsc#1209483).
• CVE-2023-0614: Fixed discovering of access controlled AD LDAP attributes (bso#15270) (bsc#1209485).

The following non-security bug was fixed:

• Prevent use after free of messaging_ctdb_fde_ev structs (bso#15293) (bsc#1207416).

This update for ldb, samba fixes the following issues:

ldb:

• CVE-2022-32746: Fixed an use-after-free issue in the database audit logging module (bsc#1201490).
• CVE-2023-0614: Fixed discovering of access controlled AD LDAP attributes (bso#15270) (bsc#1209485).

samba:

• CVE-2023-0922: Fixed cleartext password sending by AD DC admin tool (bso#15315) (bsc#1209481).
• CVE-2023-0225: Fixed deletion of AD DC 'dnsHostname' attribute by unprivileged authenticated users (bso#15276) (bsc#1209483).
• CVE-2023-0614: Fixed discovering of access controlled AD LDAP attributes (bso#15270) (bsc#1209485).

The following non-security bug were fixed:

• Prevent use after free of messaging_ctdb_fde_ev structs (bso#15293) (bsc#1207416).
• Ship missing samba-winbind-libs-32bit package (bsc#1207996)
• Ship missing samba-libs to SLE Micro 5.3 (bsc#1207723)

It was discovered that Samba did not handle MaxQueryDuration when being used in AD DC configurations, contrary to expectations. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3670)

Luke Howard discovered that Samba incorrectly handled certain restrictions associated with changing passwords. A remote attacker being requested to change passwords could possibly use this issue to escalate privileges. (CVE-2022-2031)

Luca Moro discovered that Samba incorrectly handled certain SMB1 communications. A remote attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2022-32742)

Joseph Sutton discovered that Samba incorrectly handled certain password change requests. A remote attacker could use this issue to change passwords of other users, resulting in privilege escalation. (CVE-2022-32744)

Joseph Sutton discovered that Samba incorrectly handled certain LDAP add or modify requests. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-32745)

Joseph Sutton and Andrew Bartlett discovered that Samba incorrectly handled certain LDAP add or modify requests. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-32746)