USN-6238-1: Samba vulnerabilities

Releases

• Ubuntu 23.04
• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• samba - SMB/CIFS file, print, and login server for Unix

Details

It was discovered that Samba incorrectly handled Winbind NTLM
authentication responses. An attacker could possibly use this issue to
cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)

Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet
signing. A remote attacker could possibly use this issue to obtain or
modify sensitive information. This issue only affected Ubuntu 23.04.
(CVE-2023-3347)

Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly
handled certain Spotlight requests. A remote attacker could possibly use
this issue to cause Samba to consume resources, leading to a denial of
service. (CVE-2023-34966, CVE-2023-34967)

Ralph Boehme and Stefan Metzmacher discovered that Samba incorrectly
handled paths returned by Spotlight requests. A remote attacker could
possibly use this issue to obtain sensitive information. (CVE-2023-34968)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• samba - 2:4.17.7+dfsg-1ubuntu1.1

Ubuntu 22.10

• samba - 2:4.16.8+dfsg-0ubuntu1.2

Ubuntu 22.04

• samba - 2:4.15.13+dfsg-0ubuntu1.2

Ubuntu 20.04

• samba - 2:4.15.13+dfsg-0ubuntu0.20.04.3

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-3347
• CVE-2023-34967
• CVE-2023-34968
• CVE-2023-34966
• CVE-2022-2127