CVE-2023-3347
published 2023-07-20CVE-2023-3347: A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required"…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.39%
31.3th percentile
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.17.10+dfsg-0+deb12u1 (bookworm) | samba 2:4.17.10+dfsg-0+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | storage | — | — |
| samba | samba | >= 0 < 2:4.17.10+dfsg-0+deb12u1 | 2:4.17.10+dfsg-0+deb12u1 |
| samba | samba | >= 0 < 2:4.18.5+dfsg-1 | 2:4.18.5+dfsg-1 |
| samba | samba | >= 0 < 2:4.18.5+dfsg-1 | 2:4.18.5+dfsg-1 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu0.20.04.3 | 2:4.15.13+dfsg-0ubuntu0.20.04.3 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu1.2 | 2:4.15.13+dfsg-0ubuntu1.2 |
| samba | samba | >= 4.17.0 < 4.17.10 | 4.17.10 |
| samba | samba | >= 4.18.0 < 4.18.5 | 4.18.5 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-3347: A vulnerability was found in Samba's SMB2 packet signing mechanism
osv·2023-07-20·CVSS 5.9
CVE-2023-3347 [MEDIUM] CVE-2023-3347: A vulnerability was found in Samba's SMB2 packet signing mechanism
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
GHSA
GHSA-m82c-5hpw-48f7: A vulnerability was found in Samba's SMB2 packet signing mechanism
ghsa_unreviewed·2023-07-20
CVE-2023-3347 [MEDIUM] CWE-347 GHSA-m82c-5hpw-48f7: A vulnerability was found in Samba's SMB2 packet signing mechanism
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
OSV
samba vulnerabilities
osv·2023-07-19·CVSS 5.9
CVE-2022-2127 [MEDIUM] samba vulnerabilities
samba vulnerabilities
It was discovered that Samba incorrectly handled Winbind NTLM
authentication responses. An attacker could possibly use this issue to
cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)
Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet
signing. A remote attacker could possibly use this issue to obtain or
modify sensitive information. This issue only affected Ubuntu 23.04.
(CVE-2023-3347)
Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly
handled certain Spotlight requests. A remote attacker could possibly use
this issue to cause Samba to consume resources, leading to a denial of
service. (CVE-2023-34966, CVE-2023-34967)
Ralph Boehme and Stefan Metzmacher discovered that Samba incorrectly
handled paths r
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2023-07-19·CVSS 5.9
CVE-2023-3347 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
It was discovered that Samba incorrectly handled Winbind NTLM
authentication responses. An attacker could possibly use this issue to
cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)
Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet
signing. A remote attacker could possibly use this issue to obtain or
modify sensitive information. This issue only affected Ubuntu 23.04.
(CVE-2023-3347)
Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly
handled certain Spotlight requests. A remote attacker could possibly use
this issue to cause Samba to consume resources, leading to a denial of
service. (CVE-2023-34966, CVE-2023-34967)
Ralph Boehme and Stefa
Red Hat
samba: SMB2 packet signing is not enforced when "server signing = required" is set
vendor_redhat·2023-07-19·CVSS 5.9
CVE-2023-3347 [MEDIUM] CWE-347 samba: SMB2 packet signing is not enforced when "server signing = required" is set
samba: SMB2 packet signing is not enforced when "server signing = required" is set
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This fla
Debian
CVE-2023-3347: samba - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 pac...
vendor_debian·2023·CVSS 5.9
CVE-2023-3347 [MEDIUM] CVE-2023-3347: samba - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 pac...
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
Scope: local
bookworm: resolved (fixed in 2:4.17.10+dfsg-0+deb12u1)
bullseye: resolved
forky: resolved (fixed in 2:4.18.5+dfsg-1)
sid: resolved (fixed in 2:4.18.5+dfsg-1)
trixie: resolved (fixed in 2:4.18.5+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2023:4325https://access.redhat.com/errata/RHSA-2023:4328https://access.redhat.com/security/cve/CVE-2023-3347https://bugzilla.redhat.com/show_bug.cgi?id=2222792https://www.samba.org/samba/security/CVE-2023-3347.htmlhttps://access.redhat.com/errata/RHSA-2023:4325https://access.redhat.com/errata/RHSA-2023:4328https://access.redhat.com/security/cve/CVE-2023-3347https://bugzilla.redhat.com/show_bug.cgi?id=2222792https://lists.fedoraproject.org/archives/list/[email protected]/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/https://lists.fedoraproject.org/archives/list/[email protected]/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/https://security.netapp.com/advisory/ntap-20230731-0010/https://www.debian.org/security/2023/dsa-5477https://www.samba.org/samba/security/CVE-2023-3347.html
2023-07-20
Published