Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 23.10 USN-6425-3 Critical: Samba Remote Access Risks

ubuntu
Calendar Grey October 17, 2023
Dist Ubuntu Esm H88
Recent Ubuntu advisory resolves Samba weaknesses. Enhanced security measures implemented to counter remote access dangers.
Several security issues were fixed in Samba.

Summary

Several security issues were fixed in Samba.

Software Description:

Details:

USN-6425-1 fixed vulnerabilities in Samba. This update provides the

corresponding updates for Ubuntu 23.10.

Original advisory details:

Sri Nagasubramanian discovered that the Samba acl_xattr VFS module

incorrectly handled read-only files. When Samba is configured to ignore

system ACLs, a remote attacker could possibly use this issue to truncate

read-only files. (CVE-2023-4091)

Andrew Bartlett discovered that Samba incorrectly handled the DirSync

control. A remote attacker with an RODC DC account could possibly use this

issue to obtain all domain secrets. (CVE-2023-4154)

Andrew Bartlett discovered that Samba incorrectly handled the rpcecho

development server. A remote attacker could possibly use this issue to

cause Samba to stop responding, resulting in a denial of service.

(CVE-2023-42669)

Kirin van der Veer discovered that Samba incorrectly handled cer...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical remote access samba access issue ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6425-3

https://ubuntu.com/security/notices/USN-6425-1

CVE-2023-4091, CVE-2023-4154, CVE-2023-42669, CVE-2023-42670

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6425-3

Topics%20covered

Topics Covered

security advisory denial of service critical remote access samba access issue ubuntu

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here