Moderate: samba security, bug fix, and enhancement update
Summary
ALSA-2023:6667: Moderate: samba security, bug fix, and enhancement update. Affects ctdb versions < 4.18.6-100.el9. Fixed in 4.18.6-100.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol. It allows PC-compatible machines to share files, printers, and various information. The vulnerability affects the samba package.
Vulnerability Detail
The samba package is impacted by multiple security vulnerabilities:
- CVE-2022-2127: Out-of-bounds read in winbind AUTH_CRAP.
- CVE-2023-34966: Infinite loop in mdssvc RPC service for spotlight.
- CVE-2023-34967: Type confusion in mdssvc RPC service for spotlight.
- CVE-2023-34968: Spotlight server-side share path disclosure.
These vulnerabilities can lead to various security issues, including unauthorized access, information disclosure, and denial of service.
How To Fix
Minimum fixed version
4.18.6-100.el9
This is the first release that contains the fix.
sudo dnf update ctdbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The samba package is affected by multiple security vulnerabilities. It is recommended to upgrade to version 4.18.6 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ctdb →
FAQ
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol. It allows PC-compatible machines to share files, printers, and various information.
These vulnerabilities can lead to various security issues, including unauthorized access, information disclosure, and denial of service.
To fix the vulnerabilities, it is recommended to upgrade the samba package to version 4.18.6 or later. This can be done by following the upgrade instructions provided by the package maintainer.
No specific workarounds have been mentioned for these vulnerabilities.
More information about these vulnerabilities can be found in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for ctdb.
