SUSE SLED15 / SLES15 / openSUSE 15 Security Update : samba (SUSE-SU-2023:4046-1)

critical Nessus Plugin ID 183005

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4046-1 advisory.

- The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ (Inter-Process Communication) share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0, Samba internally connects client pipe names to unix domain sockets within a private directory, allowing clients to connect to services listening on those sockets. This is usually used to connect SMB clients to remote proceedure call (RPC) services, such as SAMR LSA, or SPOOLSS, which Samba starts on demand.
However, insufficient sanitization was done on the incoming client pipe name, meaning that a client sending a pipe name containing unix directory traversal characters (../) could cause Samba to connect to unix domain sockets outside of the private directory meant to restrict the services a client could connect to. Samba connects to the unix domain sockets as root, meaning if a client could send a pipe name that resolved to an external service using an existing unix domain socket, the client would be able to connect to it without filesystem permissions restricting access. Depending on the service the client can connect to, the client may be able to trigger adverse events such as denial of service, crashing the service, or potentially compromising it. There are no current known exploits for this bug. (CVE-2023-3961)

- The vulnerability exists due to an error in the way SMB protocol implementation in Samba handles file operations. A remote user can request read-only access to files and then truncate them to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting acl_xattr:ignore system acls = yes. (CVE-2023-4091)

- The vulnerability exists due to a design error in Samba's implementation of the DirSync control, which can allow replication of critical domain passwords and secrets by Active Directory accounts authorized to do some replication, but not to replicate sensitive attributes. A remote user can obtain sensitive information from the AD DC and compromise the Active Directory. (CVE-2023-4154)

- The vulnerability exists due to inclusion of the rpcecho server into production build, which can call sleep() on AD DC. A remote user can request the server block using the rpcecho server and perform a denial of service (DoS) attack. (CVE-2023-42669)

- The vulnerability exists due to improper management of internal resources within the application when Samba RPC server is under load, which can lead to incorrect start of servers not built for the AD DC. A remote user can cause a high load to Samba RPC server and perform a denial of service (DoS) attack.
(CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 183005

File Name: suse_SU-2023-4046-1.nasl

Version: 1.2

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/13/2023

Updated: 11/14/2023

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-3961

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:samba-client-libs-32bit, p-cpe:/a:novell:suse_linux:samba-gpupdate, p-cpe:/a:novell:suse_linux:samba-winbind, p-cpe:/a:novell:suse_linux:samba-ldb-ldap, p-cpe:/a:novell:suse_linux:samba-python3, p-cpe:/a:novell:suse_linux:samba-winbind-libs, p-cpe:/a:novell:suse_linux:libsamba-policy-devel, p-cpe:/a:novell:suse_linux:samba, p-cpe:/a:novell:suse_linux:samba-ceph, p-cpe:/a:novell:suse_linux:samba-libs-python3, p-cpe:/a:novell:suse_linux:libsamba-policy-python3-devel, p-cpe:/a:novell:suse_linux:samba-client, p-cpe:/a:novell:suse_linux:samba-client-libs, p-cpe:/a:novell:suse_linux:samba-libs-32bit, p-cpe:/a:novell:suse_linux:samba-devel, p-cpe:/a:novell:suse_linux:ctdb, p-cpe:/a:novell:suse_linux:samba-tool, p-cpe:/a:novell:suse_linux:samba-libs, p-cpe:/a:novell:suse_linux:samba-winbind-libs-32bit, p-cpe:/a:novell:suse_linux:libsamba-policy0-python3, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/11/2023

Vulnerability Publication Date: 10/10/2023

Reference Information

CVE: CVE-2023-3961, CVE-2023-4091, CVE-2023-4154, CVE-2023-42669, CVE-2023-42670

IAVA: 2023-A-0535

SuSE: SUSE-SU-2023:4046-1

Detections

Analytics