Amazon Linux 2023 Security Advisory: ALAS2023-2023-316
Advisory Released Date: 2023-08-25
Advisory Updated Date: 2023-08-25
FAQs regarding Amazon Linux ALAS/CVE Severity
When doing NTLM authentication, the client sends replies to
cryptographic challenges back to the server. These replies
have variable length. Winbind did not properly bounds-check
the lan manager response length, which despite the lan
manager version no longer being used is still part of the
protocol.
If the system is running Samba's ntlm_auth as authentication backend
for services like Squid (or a very unusual configuration with
FreeRADIUS), the vulnarebility is remotely exploitable
If not so configured, or to exploit this vulnerability locally, the
user must have access to the privileged winbindd UNIX domain
socket (a subdirectory with name 'winbindd_privileged' under "state
directory", as set in the smb.conf).
This access is normally only given so special system services like
Squid or FreeRADIUS, that use this feature. (CVE-2022-2127)
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data. (CVE-2023-3347)
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. (CVE-2023-34966)
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves. (CVE-2023-34967)
A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path. (CVE-2023-34968)
Affected Packages:
samba
Issue Correction:
Run dnf update samba --releasever 2023.1.20230825 or dnf update --advisory ALAS2023-2023-316 --releasever 2023.1.20230825 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
libnetapi-4.17.10-0.amzn2023.0.1.aarch64
samba-test-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-common-libs-4.17.10-0.amzn2023.0.1.aarch64
python3-samba-dc-4.17.10-0.amzn2023.0.1.aarch64
python3-samba-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-client-libs-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
libsmbclient-devel-4.17.10-0.amzn2023.0.1.aarch64
libwbclient-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-test-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-krb5-locator-4.17.10-0.amzn2023.0.1.aarch64
samba-libs-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-4.17.10-0.amzn2023.0.1.aarch64
samba-dc-libs-4.17.10-0.amzn2023.0.1.aarch64
samba-dcerpc-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
python3-samba-test-4.17.10-0.amzn2023.0.1.aarch64
samba-libs-4.17.10-0.amzn2023.0.1.aarch64
samba-krb5-printing-4.17.10-0.amzn2023.0.1.aarch64
samba-test-libs-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-modules-4.17.10-0.amzn2023.0.1.aarch64
python3-samba-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-clients-4.17.10-0.amzn2023.0.1.aarch64
samba-debugsource-4.17.10-0.amzn2023.0.1.aarch64
samba-common-libs-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-common-tools-4.17.10-0.amzn2023.0.1.aarch64
samba-common-tools-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-test-libs-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-ldb-ldap-modules-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-client-libs-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-krb5-locator-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
libsmbclient-4.17.10-0.amzn2023.0.1.aarch64
samba-client-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-clients-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
libsmbclient-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
python3-samba-dc-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
libnetapi-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-dc-libs-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-vfs-iouring-4.17.10-0.amzn2023.0.1.aarch64
samba-dcerpc-4.17.10-0.amzn2023.0.1.aarch64
samba-client-4.17.10-0.amzn2023.0.1.aarch64
libwbclient-4.17.10-0.amzn2023.0.1.aarch64
samba-winbind-modules-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-devel-4.17.10-0.amzn2023.0.1.aarch64
samba-ldb-ldap-modules-4.17.10-0.amzn2023.0.1.aarch64
libnetapi-devel-4.17.10-0.amzn2023.0.1.aarch64
samba-vfs-iouring-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
libwbclient-devel-4.17.10-0.amzn2023.0.1.aarch64
samba-krb5-printing-debuginfo-4.17.10-0.amzn2023.0.1.aarch64
samba-tools-4.17.10-0.amzn2023.0.1.aarch64
python3-samba-devel-4.17.10-0.amzn2023.0.1.aarch64
samba-usershares-4.17.10-0.amzn2023.0.1.aarch64
noarch:
samba-pidl-4.17.10-0.amzn2023.0.1.noarch
samba-common-4.17.10-0.amzn2023.0.1.noarch
src:
samba-4.17.10-0.amzn2023.0.1.src
x86_64:
python3-samba-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
libnetapi-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-common-libs-4.17.10-0.amzn2023.0.1.x86_64
samba-client-libs-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-clients-4.17.10-0.amzn2023.0.1.x86_64
libwbclient-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
python3-samba-dc-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-modules-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-test-libs-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
libnetapi-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-clients-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-common-libs-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-common-tools-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-4.17.10-0.amzn2023.0.1.x86_64
samba-test-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-libs-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
python3-samba-dc-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-libs-4.17.10-0.amzn2023.0.1.x86_64
libsmbclient-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
python3-samba-test-4.17.10-0.amzn2023.0.1.x86_64
samba-client-4.17.10-0.amzn2023.0.1.x86_64
samba-dcerpc-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-4.17.10-0.amzn2023.0.1.x86_64
samba-test-4.17.10-0.amzn2023.0.1.x86_64
samba-debugsource-4.17.10-0.amzn2023.0.1.x86_64
samba-client-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
libsmbclient-4.17.10-0.amzn2023.0.1.x86_64
samba-common-tools-4.17.10-0.amzn2023.0.1.x86_64
samba-devel-4.17.10-0.amzn2023.0.1.x86_64
samba-dcerpc-4.17.10-0.amzn2023.0.1.x86_64
samba-client-libs-4.17.10-0.amzn2023.0.1.x86_64
python3-samba-4.17.10-0.amzn2023.0.1.x86_64
libsmbclient-devel-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-modules-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-krb5-locator-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-test-libs-4.17.10-0.amzn2023.0.1.x86_64
samba-dc-libs-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-ldb-ldap-modules-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
libnetapi-devel-4.17.10-0.amzn2023.0.1.x86_64
samba-vfs-iouring-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
libwbclient-4.17.10-0.amzn2023.0.1.x86_64
libwbclient-devel-4.17.10-0.amzn2023.0.1.x86_64
samba-dc-libs-4.17.10-0.amzn2023.0.1.x86_64
samba-ldb-ldap-modules-4.17.10-0.amzn2023.0.1.x86_64
samba-winbind-krb5-locator-4.17.10-0.amzn2023.0.1.x86_64
samba-vfs-iouring-4.17.10-0.amzn2023.0.1.x86_64
samba-krb5-printing-debuginfo-4.17.10-0.amzn2023.0.1.x86_64
samba-krb5-printing-4.17.10-0.amzn2023.0.1.x86_64
samba-tools-4.17.10-0.amzn2023.0.1.x86_64
python3-samba-devel-4.17.10-0.amzn2023.0.1.x86_64
samba-usershares-4.17.10-0.amzn2023.0.1.x86_64