CVE-2022-2127
published 2023-07-20CVE-2022-2127: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
1.53%
71.9th percentile
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | samba | < samba 2:4.17.10+dfsg-0+deb12u1 (bookworm) | samba 2:4.17.10+dfsg-0+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| samba | samba | >= 0 < 2:4.13.13+dfsg-1~deb11u6 | 2:4.13.13+dfsg-1~deb11u6 |
| samba | samba | >= 0 < 2:4.17.10+dfsg-0+deb12u1 | 2:4.17.10+dfsg-0+deb12u1 |
| samba | samba | >= 0 < 2:4.18.5+dfsg-1 | 2:4.18.5+dfsg-1 |
| samba | samba | >= 0 < 2:4.18.5+dfsg-1 | 2:4.18.5+dfsg-1 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu0.20.04.3 | 2:4.15.13+dfsg-0ubuntu0.20.04.3 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu1.2 | 2:4.15.13+dfsg-0ubuntu1.2 |
| samba | samba | >= 4.16.0 < 4.16.10 | 4.16.10 |
| samba | samba | >= 4.17.0 < 4.17.9 | 4.17.9 |
| samba | samba | >= 4.18.0 < 4.18.4 | 4.18.4 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-2127: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap
osv·2023-07-20·CVSS 5.9
CVE-2022-2127 [MEDIUM] CVE-2022-2127: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
GHSA
GHSA-mfwc-hx97-869v: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap
ghsa_unreviewed·2023-07-20
CVE-2022-2127 [MEDIUM] CWE-125 GHSA-mfwc-hx97-869v: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
OSV
samba vulnerabilities
osv·2023-07-19·CVSS 5.9
CVE-2022-2127 [MEDIUM] samba vulnerabilities
samba vulnerabilities
It was discovered that Samba incorrectly handled Winbind NTLM
authentication responses. An attacker could possibly use this issue to
cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)
Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet
signing. A remote attacker could possibly use this issue to obtain or
modify sensitive information. This issue only affected Ubuntu 23.04.
(CVE-2023-3347)
Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly
handled certain Spotlight requests. A remote attacker could possibly use
this issue to cause Samba to consume resources, leading to a denial of
service. (CVE-2023-34966, CVE-2023-34967)
Ralph Boehme and Stefan Metzmacher discovered that Samba incorrectly
handled paths r
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2023-07-19·CVSS 5.9
CVE-2023-3347 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
It was discovered that Samba incorrectly handled Winbind NTLM
authentication responses. An attacker could possibly use this issue to
cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)
Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet
signing. A remote attacker could possibly use this issue to obtain or
modify sensitive information. This issue only affected Ubuntu 23.04.
(CVE-2023-3347)
Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly
handled certain Spotlight requests. A remote attacker could possibly use
this issue to cause Samba to consume resources, leading to a denial of
service. (CVE-2023-34966, CVE-2023-34967)
Ralph Boehme and Stefa
Red Hat
samba: out-of-bounds read in winbind AUTH_CRAP
vendor_redhat·2023-07-19·CVSS 5.9
CVE-2022-2127 [MEDIUM] CWE-125 samba: out-of-bounds read in winbind AUTH_CRAP
samba: out-of-bounds read in winbind AUTH_CRAP
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to
Debian
CVE-2022-2127: samba - An out-of-bounds read vulnerability was found in Samba due to insufficient lengt...
vendor_debian·2022·CVSS 5.9
CVE-2022-2127 [MEDIUM] CVE-2022-2127: samba - An out-of-bounds read vulnerability was found in Samba due to insufficient lengt...
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.
Scope: local
bookworm: resolved (fixed in 2:4.17.10+dfsg-0+deb12u1)
bullseye: resolved (fixed in 2:4.13.13+dfsg-1~deb11u6)
forky: resolved (fixed in 2:4.18.5+dfsg-1)
sid: resolved (fixed in 2:4.18.5+dfsg-1)
trixie: resolved (fixed in 2:4.18.5+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2023:6667https://access.redhat.com/errata/RHSA-2023:7139https://access.redhat.com/errata/RHSA-2024:0423https://access.redhat.com/errata/RHSA-2024:0580https://access.redhat.com/security/cve/CVE-2022-2127https://bugzilla.redhat.com/show_bug.cgi?id=2222791https://www.samba.org/samba/security/CVE-2022-2127.htmlhttps://access.redhat.com/errata/RHSA-2023:6667https://access.redhat.com/errata/RHSA-2023:7139https://access.redhat.com/errata/RHSA-2024:0423https://access.redhat.com/errata/RHSA-2024:0580https://access.redhat.com/security/cve/CVE-2022-2127https://bugzilla.redhat.com/show_bug.cgi?id=2222791https://lists.debian.org/debian-lts-announce/2024/04/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/https://lists.fedoraproject.org/archives/list/[email protected]/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/https://security.netapp.com/advisory/ntap-20230731-0010/https://www.debian.org/security/2023/dsa-5477https://www.samba.org/samba/security/CVE-2022-2127.html
2023-07-20
Published