Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 23.04: USN-6425-1 Critical Samba Remote Access Threats

ubuntu
Calendar Grey October 10, 2023
Dist Ubuntu Esm H88
Several critical Samba security updates for Ubuntu tackle severe vulnerabilities, encompassing risks of unauthorized remote access and potential denial of service attacks.
Several security issues were fixed in Samba.

Summary

Several security issues were fixed in Samba.

Software Description:

- samba: SMB/CIFS file, print, and login server for Unix

Details:

Sri Nagasubramanian discovered that the Samba acl_xattr VFS module

incorrectly handled read-only files. When Samba is configured to ignore

system ACLs, a remote attacker could possibly use this issue to truncate

read-only files. (CVE-2023-4091)

Andrew Bartlett discovered that Samba incorrectly handled the DirSync

control. A remote attacker with an RODC DC account could possibly use this

issue to obtain all domain secrets. (CVE-2023-4154)

Andrew Bartlett discovered that Samba incorrectly handled the rpcecho

development server. A remote attacker could possibly use this issue to

cause Samba to stop responding, resulting in a denial of service.

(CVE-2023-42669)

Kirin van der Veer discovered that Samba incorrectly handled certain RPC

service listeners. A remote attacker could possibly use this issue to cause

Samba to start mul...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service security issue remote access samba ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   samba                           2:4.17.7+dfsg-1ubuntu2.3

Ubuntu 22.04 LTS:
   samba                           2:4.15.13+dfsg-0ubuntu1.5

Ubuntu 20.04 LTS:
   samba                           2:4.15.13+dfsg-0ubuntu0.20.04.6

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6425-1

CVE-2023-4091, CVE-2023-4154, CVE-2023-42669, CVE-2023-42670

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6425-1

Topics%20covered

Topics Covered

security advisory denial of service security issue remote access samba ubuntu

Package Information

https://launchpad.net/ubuntu/+source/samba/2:4.17.7+dfsg-1ubuntu2.3
https://launchpad.net/ubuntu/+source/samba/2:4.15.13+dfsg-0ubuntu1.5
https://launchpad.net/ubuntu/+source/samba/2:4.15.13+dfsg-0ubuntu0.20.04.6

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here