{"id":"MGASA-2022-0054","summary":"Updated samba packages fix security vulnerability","details":"For CVE-2021-20316 and CVE-2021-44141, there is only a workaround and\nmitigation:\n\nAll versions of Samba prior to 4.15.5 are vulnerable to a malicious\nclient using a server symlink to determine if a file or directory\nexists in an area of the server file system not exported under the\nshare definition. SMB1 with unix extensions has to be enabled in order\nfor this attack to succeed.\n\nClients that have write access to the exported part of the file system\nunder a share via SMB1 unix extensions or via NFS can create symlinks\nthat point to arbitrary files or directories on the server filesystem.\n\nClients can then use SMB1 unix extension information queries to\ndetermine if the target of the symlink exists or not by examining\nerror codes returned from the smbd server. There is no ability to\naccess these files or directories, only to determine if they exist or\nnot.\n\nIf SMB1 is turned off and only SMB2 is used, or unix extensions are\nnot enabled then there is no way to discover if a symlink points to a\nvalid target or not via SMB2. For this reason, even if symlinks are\ncreated via NFS, if the Samba server does not allow SMB1 with unix\nextensions there is no way to exploit this bug.\n\nFinding out what files or directories exist on a file server can help\nattackers guess system user names or the exact operating system\nrelease and applications running on the server hosting Samba which may\nhelp mount further attacks.\n\nSMB1 has been disabled on Samba since version 4.11.0 and\nonwards. Exploitation of this bug has not been seen in the wild.\n\nFor CVE-2021-44142, All versions of Samba prior to 4.13.17 are vulnerable\nto an out-of-bounds heap read write vulnerability that allows remote\nattackers to execute arbitrary code as root on affected Samba\ninstallations that use the VFS module vfs_fruit.\n\nThe specific flaw exists within the parsing of EA metadata when\nopening files in smbd. Access as a user that has write access to a\nfile's extended attributes is required to exploit this\nvulnerability. Note that this could be a guest or unauthenticated user\nif such users are allowed write access to file extended attributes.\n\nThe problem in vfs_fruit exists in the default configuration of the\nfruit VFS module using fruit:metadata=netatalk or fruit:resource=file.\nIf both options are set to different settings than the default values,\nthe system is not affected by the security issue.\n\nFor CVE-2022-0336, The Samba AD DC includes checks when adding service\nprincipals names (SPNs) to an account to ensure that SPNs do not alias\nwith those already in the database. Some of these checks are able to be\nbypassed if an account modification re-adds an SPN that was previously\npresent on that account, such as one added when a computer is joined to\na domain.\n\nAn attacker who has the ability to write to an account can exploit\nthis to perform a denial-of-service attack by adding an SPN that\nmatches an existing service. Additionally, an attacker who can\nintercept traffic can impersonate existing services, resulting in a\nloss of confidentiality and integrity.\n","modified":"2026-04-16T04:42:02.220658266Z","published":"2022-02-09T20:46:00Z","upstream":["CVE-2021-20316","CVE-2021-44141","CVE-2021-44142","CVE-2022-0336"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2022-0054.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=29974"},{"type":"ADVISORY","url":"https://www.samba.org/samba/security/CVE-2021-44141.html"},{"type":"ADVISORY","url":"https://www.samba.org/samba/security/CVE-2021-44142.html"},{"type":"ADVISORY","url":"https://www.samba.org/samba/security/CVE-2022-0336.html"},{"type":"WEB","url":"https://www.samba.org/samba/history/samba-4.14.12.html"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5260-1"},{"type":"ADVISORY","url":"https://www.samba.org/samba/security/CVE-2021-20316.html"},{"type":"WEB","url":"https://lists.suse.com/pipermail/sle-security-updates/2022-February/010164.html"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/72ZRNFZ3DE3TJA7HFCVV476YJN6I4B5M/"}],"affected":[{"package":{"name":"samba","ecosystem":"Mageia:8","purl":"pkg:rpm/mageia/samba?arch=source&distro=mageia-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.12-1.mga8"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2022-0054.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}