CVE-2023-34968

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190417)

Security Fix(es):

• samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

• samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

• samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

• samba: spotlight server-side share path disclosure (CVE-2023-34968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190415)

Security Fix(es):

• samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)
• samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)
• samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)
• samba: spotlight server-side share path disclosure (CVE-2023-34968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190417)

Security Fix(es):

• samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)
• samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)
• samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)
• samba: spotlight server-side share path disclosure (CVE-2023-34968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-4091: fix file truncation issue in acl_xattr module by enforcing kernel file system permissions checks, use open_access_mask for access check in open_file() in smbd
• CVE-2023-34967: fix type confusion vulnerability in mdssvc RPC service by implementing proper type checking in dalloc_value_for_key function
• CVE-2023-34968: fix path disclosure vulnerability by sanitizing search query results
• CVE-2023-42669: disable the rpcecho server

• Fix CVE-2023-34968: fix path disclosure vulnerability by sanitizing search query results
• Delete fixed tests from knowfail list

• Rebase onto RHEL samba-4.14.5-9.el8_5: CVE-2021-44142, the CVE-2020-25717 username map script regression, the domain-join segfault and the dangling symlink directory deletion fixes are now provided by the base.
• Re-apply TuxCare ELS security backports on the new base:
• CVE-2022-32742: fix server memory information leak via SMB1
• CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC
• CVE-2022-1615: util/genrand: don't ignore errors in random number generation
• CVE-2022-2127: fix out-of-bounds read triggered by a malicious request
• CVE-2023-34966: fix infinite loop vulnerability in mdssvc RPC service
• CVE-2023-3961: fix a path traversal out of the socket directory
• CVE-2023-4091: fix file truncation issue in acl_xattr module
• CVE-2023-34967: fix type confusion vulnerability in mdssvc RPC service
• CVE-2023-34968: fix path disclosure vulnerability in mdssvc
• CVE-2023-42669: disable the rpcecho server
• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J

Out-of-bounds read due to insufficient length checks in winbindd_pam_auth_crap.c (CVE-2022-2127) Improper SMB2 packet signing mechanism leading to man in the middle risk (CVE-2023-3347) Infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight (CVE-2023-34966) Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight (CVE-2023-34967) Path disclosure vulnerability in the Spotlight protocol (CVE-2023-34968)

These are all security issues fixed in the ctdb-4.18.5+git.313.c8e274c7852-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2022-2127: Fixed issue where lm_resp_len was not checked properly in winbindd_pam_auth_crap_send (bsc#1213174).
• CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173).
• CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172).
• CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171).

Bugfixes:

• Fixed trust relationship failure (bsc#1213384).

This update for samba fixes the following issues:

samba was updated to version 4.17.9:

• CVE-2022-2127: Fixed issue where lm_resp_len was not checked properly in winbindd_pam_auth_crap_send (bsc#1213174).
• CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173).
• CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172).
• CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171).
• CVE-2023-3347: Fixed issue where SMB2 packet signing not enforced (bsc#1213170).
• CVE-2020-25720: Fixed issue where creating child permission allowed full write to all attributes (bsc#1213386).

Bugfixes:

• Fixed trust relationship failure (bsc#1213384).
• Backported --pidl-developer fixes.
• Fixed smbd_scavenger crash when service smbd is stopped.
• Fixed issue where vfs_fruit might cause a failing open for delete.
• Fixed named crashes on DLZ zone update.
• Fixed issue where winbind recurses into itself via rpcd_lsad.
• Fixed cli_list looping 100% CPU against pre-lanman2 servers.
• Fixed smbclient leaks fds with showacls.
• Fixed aes256 smb3 encryption algorithms not allowed in smb3_sid_parse().
• Fixed winbindd getting stuck on NT_STATUS_RPC_SEC_PKG_ERROR.
• Fixed smbget memory leak if failed to download files recursively.
• Fixed log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower.
• Fixed floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c.
• Fixed test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners.
• Reduce flapping of ridalloc test.
• Fixed unreliable large_ldap test.
• Fixed filename parser not checking veto files smb.conf parameter.
• Fixed mdssvc may crash when initializing.
• Fixed broken large directory optimization for non-lcomp path elements
• Fixed streams_depot failing to create streams.
• Fixed shadow_copy2 and streams_depot issues.
• Fixed wbinfo -u fails on ad dc with >1000 users.
• Fixed winbindd idmap child contacting the domain controller without a need.
• Fixed idmap_autorid may fail to map sids of trusted domains for the first time.
• Fixed idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings.
• Fixed net ads search -P doesn't work against servers in other domains.
• Fixed DS ACEs might be inherited to unrelated object classes.
• Fixed temporary smbXsrv_tcon_global.tdb can't be parsed.
• Fixed setting veto files = /.*/ breaking listing directories (bsc#1212375).
• Fixed dsgetdcname assuming local system uses IPv4.

This update for samba fixes the following issues:

• CVE-2022-2127: Fixed issue where lm_resp_len was not checked properly in winbindd_pam_auth_crap_send (bsc#1213174).
• CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173).
• CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172).
• CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171).

Bugfixes:

• Fixed trust relationship failure (bsc#1213384).

This update for samba fixes the following issues:

• CVE-2022-2127: Fixed issue where lm_resp_len was not checked properly in winbindd_pam_auth_crap_send (bsc#1213174).
• CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173).
• CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172).
• CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171).

Bugfixes:

• Fixed trust relationship failure (bsc#1213384).

This update for samba fixes the following issues:

• CVE-2022-2127: Fixed issue where lm_resp_len was not checked properly in winbindd_pam_auth_crap_send (bsc#1213174).
• CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173).
• CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172).
• CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171).

Bugfixes:

• Fixed trust relationship failure (bsc#1213384).

It was discovered that Samba incorrectly handled Winbind NTLM authentication responses. An attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)

Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet signing. A remote attacker could possibly use this issue to obtain or modify sensitive information. This issue only affected Ubuntu 23.04. (CVE-2023-3347)

Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly handled certain Spotlight requests. A remote attacker could possibly use this issue to cause Samba to consume resources, leading to a denial of service. (CVE-2023-34966, CVE-2023-34967)

Ralph Boehme and Stefan Metzmacher discovered that Samba incorrectly handled paths returned by Spotlight requests. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-34968)