Skip to main content

Samba Releases Multiple Security Updates

These updates address four vulnerabilities including three with a CVSSv3 score of 8.1 and one with a score of 7.2

Threat ID:
CC-4233
Threat Severity:
Information only
Published:
19 December 2022 3:51 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

These updates address four vulnerabilities including three with a CVSSv3 score of 8.1 and one with a score of 7.2

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 4.15.13, 4.16.8, and 4.17.4

Samba

Threat details

Introduction

Samba has released security updates to address four vulnerabilities in multiple versions of Samba, the open-source Server Message Block (SMB) application for Linux and Unix systems. CVE-2022-38023 refers to the use of weak RC4-HMAC Kerberos encryption type in the NetLogon Secure Channel. CVE-2022-45141 is related to the use of RC4-HMAC encryption when issuing Kerberos tickets in Samba Active Directory domain controller (AD DC) using Heimdal. CVE-2022-37967 and CVE-2022-37966 are respectively related to an elevation of privilege vulnerability in Windows Kerberos and Windows Kerberos RC4-HMAC. An attack could exploit some of these vulnerabilities to perform an privilege escalation attack.

Remediation advice

Affected organisations are encouraged to review Samba's security advisories and to apply the relevant updates where applicable.

Last edited: 19 December 2022 3:51 pm