CVE-2022-38023

Netlogon RPC Elevation of Privilege Vulnerability

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

Netlogon RPC Elevation of Privilege Vulnerability.(CVE-2022-38023)

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Netlogon RPC Elevation of Privilege Vulnerability

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Netlogon RPC Elevation of Privilege Vulnerability

• CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC

• CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC

• Rebase onto RHEL samba-4.14.5-9.el8_5: CVE-2021-44142, the CVE-2020-25717 username map script regression, the domain-join segfault and the dangling symlink directory deletion fixes are now provided by the base.
• Re-apply TuxCare ELS security backports on the new base:
• CVE-2022-32742: fix server memory information leak via SMB1
• CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC
• CVE-2022-1615: util/genrand: don't ignore errors in random number generation
• CVE-2022-2127: fix out-of-bounds read triggered by a malicious request
• CVE-2023-34966: fix infinite loop vulnerability in mdssvc RPC service
• CVE-2023-3961: fix a path traversal out of the socket directory
• CVE-2023-4091: fix file truncation issue in acl_xattr module
• CVE-2023-34967: fix type confusion vulnerability in mdssvc RPC service
• CVE-2023-34968: fix path disclosure vulnerability in mdssvc
• CVE-2023-42669: disable the rpcecho server
• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J

• SECURITY UPDATE: netlogon secure channel allowed RC4/HMAC-MD5 downgrade and unsealed (unencrypted) use, permitting man-in-the-middle attacks
  • debian/patches/CVE-2022-38023.patch: change "reject md5 clients" and "reject md5 servers" defaults to yes, deprecate "allow nt4 crypto" and "reject md5 clients", add "server schannel require seal" (default yes) and require DCERPC_AUTH_LEVEL_PRIVACY in the source3 and source4 netlogon servers including all netr_LogonSamLogon* variants, defer the ServerAuthenticate3 downgrade check until the account is found in the SAM so that "server reject md5 schannel:COMPUTERACCOUNT" and "allow nt4 crypto:COMPUTERACCOUNT" exceptions apply
  • CVE-2022-38023

There is a limited write heap buffer overflow in the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal (included in Samba). Some SMB1 write requests were not correctly range checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client supplied data. The client cannot control the area of the server memory that is written to the file (or printer) (CVE-2022-3437)

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem. (CVE-2022-3592)

Active directory elevation of privilege vulnerability (CVE-2022-37966)

Active directory elevation of privilege vulnerability (CVE-2022-37967)

A flaw was found in samba. The Netlogon RPC implementations may use the rc4-hmac encryption algorithm, which is considered weak and should be avoided even if the client supports more modern encryption types. This issue could allow an attacker who knows the plain text content communicated between the samba client and server to craft data with the same MD5 calculation and replace it without being detected. (CVE-2022-38023)

Active directory integer overflow (CVE-2022-42898)

Active directory can be forced to issue weak rc4-hmac encrypted tickets (CVE-2022-45141)

These are all security issues fixed in the ctdb-4.17.4+git.300.305b22bfce-1.1 package on the GA media of openSUSE Tumbleweed.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for samba fixes the following issues:

Update to 4.15.13

• CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers (bsc#1205385).
• CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC (bsc#1205386).
• CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (bsc#1206504).
• Fixed issue with bind start up (bsc#1205946).

This update for samba fixes the following issues:

• Updated to version 4.15.13:
  • CVE-2022-38023: Removed weak cryptographic algorithms from the Netlogon RPC implementation (bsc#1206504).
  • CVE-2022-42898: Fixed several buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).
  • CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3() (bsc#1204254).
  • CVE-2022-32742: Fixed an information disclosure issue affecting SMB1 servers (bsc#1201496).
  • CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
  • CVE-2022-2031: Fixed an AD restriction bypass associated with changing passwords (bsc#1201495).
  • CVE-2022-32745: Fixed a remote server crash that could be triggered with certain LDAP requests (bsc#1201492).
  • CVE-2022-32744: Fixed an issue where AD users could have forged password change requests on behalf of other users (bsc#1201493).

Other fixes:

• Fixed a potential crash due to a concurrency issue (bsc#1200102).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).
• CVE-2020-14323: Fixed a denial of service in winbindd (bsc#1173994).
• CVE-2022-32742: Fixed incorrect length check in SMB1write, SMB1write_and_close, SMB1write_and_unlock (bsc#1201496).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).

• Updated to version 4.15.13:

  • CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).
  • CVE-2022-37967: Fixed a potential privilege escalation issue via constrained delegation due to weak a cryptographic algorithm being selected (bsc#1205386).
  • CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).

• Updated to version 4.15.12:

  • CVE-2022-42898: Fixed several buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).

• Updated to version 4.15.11:

  • CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3() (bsc#1204254).

• Updated to version 4.15.10:

  • Fixed a potential crash due to a concurrency issue (bsc#1200102).

• Updated to version 4.15.9:

  • CVE-2022-32742: Fixed an information leak that could be triggered via SMB1 (bsc#1201496).
  • CVE-2022-32746: Fixed a memory corruption issue in database audit logging (bsc#1201490).
  • CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
  • CVE-2022-32745: Fixed a remote server crash that could be triggered with certain LDAP requests (bsc#1201492).
  • CVE-2022-32744: Fixed an issue where AD users could have forged password change requests on behalf of other users (bsc#1201493).

Other fixes:

• Fixed a problem when using bind as samba-ad-dc backend related to the named service (bsc#1201689).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed bad password count that was not incremented atomically (bsc#1206546).
• CVE-2022-38023: Fixed weak RC4/HMAC-MD5 NetLogon Secure Channel usage should be avoided (bsc#1206504).
• CVE-2022-37966: Fixed privilege elevation vulnerability with option 'kerberos encryption types = legacy' which would force RC4-HMAC as a client even if the server supports AES (bsc#1205385).

It was discovered that Samba incorrectly handled the bad password count logic. A remote attacker could possibly use this issue to bypass bad passwords lockouts. This issue was only addressed in Ubuntu 22.10. (CVE-2021-20251)

Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-3437)

Tom Tervoort discovered that Samba incorrectly used weak rc4-hmac Kerberos keys. A remote attacker could possibly use this issue to elevate privileges. (CVE-2022-37966, CVE-2022-37967)

It was discovered that Samba supported weak RC4/HMAC-MD5 in NetLogon Secure Channel. A remote attacker could possibly use this issue to elevate privileges. (CVE-2022-38023)

Greg Hudson discovered that Samba incorrectly handled PAC parsing. On 32-bit systems, a remote attacker could use this issue to escalate privileges, or possibly execute arbitrary code. (CVE-2022-42898)

Joseph Sutton discovered that Samba could be forced to issue rc4-hmac encrypted Kerberos tickets. A remote attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45141)

WARNING: The fixes included in these updates introduce several important behavior changes which may cause compatibility problems interacting with systems still expecting the former behavior. Please see the following upstream advisories for more information:

https://www.samba.org/samba/security/CVE-2022-37966.html https://www.samba.org/samba/security/CVE-2022-37967.html https://www.samba.org/samba/security/CVE-2022-38023.html

Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-3437)

Tom Tervoort discovered that Samba incorrectly used weak rc4-hmac Kerberos keys. A remote attacker could possibly use this issue to elevate privileges. (CVE-2022-37966, CVE-2022-37967)

It was discovered that Samba supported weak RC4/HMAC-MD5 in NetLogon Secure Channel. A remote attacker could possibly use this issue to elevate privileges. (CVE-2022-38023)

Greg Hudson discovered that Samba incorrectly handled PAC parsing. On 32-bit systems, a remote attacker could use this issue to escalate privileges, or possibly execute arbitrary code. (CVE-2022-42898)

Joseph Sutton discovered that Samba could be forced to issue rc4-hmac encrypted Kerberos tickets. A remote attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45141)

WARNING: This update upgrades the version of Samba to 4.15.13. Please see the upstream release notes for important changes in the new version:

https://www.samba.org/samba/history/samba-4.15.0.html

In addition, the security fixes included in this new version introduce several important behavior changes which may cause compatibility problems interacting with systems still expecting the former behavior. Please see the following upstream advisories for more information:

https://www.samba.org/samba/security/CVE-2022-37966.html https://www.samba.org/samba/security/CVE-2022-37967.html https://www.samba.org/samba/security/CVE-2022-38023.html