CVE-2023-0614 — Sensitive Information Exposure in Samba

CWE-200 — Sensitive Information ExposureCWE-312 — Cleartext Storage of Sensitive Info10 documents8 sources
Severity
6.5MEDIUMNVD
CNA4.3
EPSS
0.2%
top 59.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Samba
Timeline
PublishedApr 3
Latest updateApr 11

Description

The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶NVDsamba/samba4.0.0 — 4.16.10+2
▶Debiansamba/samba< 2:4.17.7+dfsg-1+2
▶Ubuntusamba/samba< 2:4.15.13+dfsg-0ubuntu0.20.04.2+1
▶CVEListV5samba/sambasamba 4.18.1, samba 4.17.7, samba 4.16.10

🔴Vulnerability Details

4
GHSA
GHSA-8pwj-3gh6-824j: The fix in 4↗2023-04-04
▶
OSV
samba vulnerabilities↗2023-04-03
▶
CVEList
CVE-2023-0614: The fix in 4↗2023-04-03
▶
OSV
CVE-2023-0614: The fix in 4↗2023-04-03
▶

📋Vendor Advisories

5
Microsoft
The fix in 4.6.16 4.7.9 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys↗2023-04-11
▶
Ubuntu
Samba vulnerabilities↗2023-04-03
▶
Ubuntu
ldb vulnerability↗2023-04-03
▶
Red Hat
samba: Access controlled AD LDAP attributes can be discovered↗2023-03-29
▶
Debian
CVE-2023-0614: samba - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attrib...↗2023
▶