CVE-2023-34967
published 2023-07-20CVE-2023-34967: A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is…
PriorityP347medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
60.94%
99.1th percentile
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | netatalk | < netatalk 3.1.12~ds-8+deb11u1 (bullseye) | netatalk 3.1.12~ds-8+deb11u1 (bullseye) |
| debian | samba | < samba 2:4.17.10+dfsg-0+deb12u1 (bookworm) | samba 2:4.17.10+dfsg-0+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| netatalk | netatalk | >= 0 < 3.1.12~ds-8+deb11u1 | 3.1.12~ds-8+deb11u1 |
| netatalk | netatalk | >= 0 < 3.1.17~ds-1 | 3.1.17~ds-1 |
| netatalk | netatalk | >= 0 < 3.1.17~ds-1 | 3.1.17~ds-1 |
| netatalk | netatalk | >= 3.1 < 3.1.17 | 3.1.17 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| samba | samba | < 4.16.11 | 4.16.11 |
| samba | samba | >= 0 < 2:4.13.13+dfsg-1~deb11u6 | 2:4.13.13+dfsg-1~deb11u6 |
| samba | samba | >= 0 < 2:4.17.10+dfsg-0+deb12u1 | 2:4.17.10+dfsg-0+deb12u1 |
| samba | samba | >= 0 < 2:4.18.5+dfsg-1 | 2:4.18.5+dfsg-1 |
| samba | samba | >= 0 < 2:4.18.5+dfsg-1 | 2:4.18.5+dfsg-1 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu0.20.04.3 | 2:4.15.13+dfsg-0ubuntu0.20.04.3 |
| samba | samba | >= 0 < 2:4.15.13+dfsg-0ubuntu1.2 | 2:4.15.13+dfsg-0ubuntu1.2 |
| samba | samba | >= 4.17.0 < 4.17.10 | 4.17.10 |
| samba | samba | >= 4.18.0 < 4.18.5 | 4.18.5 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: malicious Spotlight mdssvc RPC packets sent to Samba's mdssvc RPC service causing a crash in talloc_get_size() via type confusion in dalloc_value_for_key() ↗
- →Target service to monitor: Samba mdssvc RPC service (Spotlight). Crashes in the shared RPC worker process (mdssvc worker) are a strong indicator of exploitation attempts. ↗
- →Monitor for unexpected crashes of the Samba mdssvc RPC worker process, especially when multiple clients share the same worker — a crash affecting all clients simultaneously is a key signal. ↗
- →Attack vector: parsing of Spotlight mdssvc RPC packets containing a key-value dictionary with unexpected/mismatched value types. Inspect RPC traffic to Samba's Spotlight service for malformed type-confused dictionary entries. ↗
- ·The vulnerability only affects Samba deployments with Spotlight (mdssvc RPC service) enabled. Installations without Spotlight configured are not affected. ↗
- ·Impact is a Denial of Service (process crash) affecting all clients sharing the same RPC worker process — not limited to the attacker's own session. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.9MEDIUM
vendor_ubuntu5.9MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2023-07-19·CVSS 5.9
CVE-2023-3347 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
It was discovered that Samba incorrectly handled Winbind NTLM
authentication responses. An attacker could possibly use this issue to
cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)
Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet
signing. A remote attacker could possibly use this issue to obtain or
modify sensitive information. This issue only affected Ubuntu 23.04.
(CVE-2023-3347)
Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly
handled certain Spotlight requests. A remote attacker could possibly use
this issue to cause Samba to consume resources, leading to a denial of
service. (CVE-2023-34966, CVE-2023-34967)
Ralph Boehme and Stefa
Red Hat
samba: type confusion in mdssvc RPC service for spotlight
vendor_redhat·2023-07-19·CVSS 5.3
CVE-2023-34967 [MEDIUM] CWE-843 samba: type confusion in mdssvc RPC service for spotlight
samba: type confusion in mdssvc RPC service for spotlight
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all oth
Debian
CVE-2023-34967: samba - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotl...
vendor_debian·2023·CVSS 5.3
CVE-2023-34967 [MEDIUM] CVE-2023-34967: samba - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotl...
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
Scope: local
bookworm: resol
Debian
CVE-2023-42464: netatalk - A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd ...
vendor_debian·2023·CVSS 5.3
CVE-2023-42464 [MEDIUM] CVE-2023-42464: netatalk - A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd ...
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.
Scope: local
bullseye: resolved (fixed in 3.1.12~ds-8+deb11u1)
forky: resolved (fixed in 3.1.17~ds-1)
sid: resolved (fixed in 3.1.17~ds-1)
trixie: resolved (fixed in 3.1.17~
GHSA
GHSA-qv4g-5q5g-2vc3: A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3
ghsa_unreviewed·2023-09-20·CVSS 5.3
CVE-2023-42464 [MEDIUM] CWE-843 GHSA-qv4g-5q5g-2vc3: A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.
OSV
CVE-2023-42464: A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3
osv·2023-09-20·CVSS 5.3
CVE-2023-42464 [MEDIUM] CVE-2023-42464: A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.
OSV
CVE-2023-34967: A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight
osv·2023-07-20·CVSS 5.3
CVE-2023-34967 [MEDIUM] CVE-2023-34967: A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
GHSA
GHSA-86p4-vhr6-2vv3: A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight
ghsa_unreviewed·2023-07-20
CVE-2023-34967 [MEDIUM] CWE-843 GHSA-86p4-vhr6-2vv3: A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
OSV
samba vulnerabilities
osv·2023-07-19·CVSS 5.9
CVE-2022-2127 [MEDIUM] samba vulnerabilities
samba vulnerabilities
It was discovered that Samba incorrectly handled Winbind NTLM
authentication responses. An attacker could possibly use this issue to
cause Samba to crash, resulting in a denial of service. (CVE-2022-2127)
Andreas Schneider discovered that Samba incorrectly enforced SMB2 packet
signing. A remote attacker could possibly use this issue to obtain or
modify sensitive information. This issue only affected Ubuntu 23.04.
(CVE-2023-3347)
Florent Saudel and Arnaud Gatignolof discovered that Samba incorrectly
handled certain Spotlight requests. A remote attacker could possibly use
this issue to cause Samba to consume resources, leading to a denial of
service. (CVE-2023-34966, CVE-2023-34967)
Ralph Boehme and Stefan Metzmacher discovered that Samba incorrectly
handled paths r
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2023:6667https://access.redhat.com/errata/RHSA-2023:7139https://access.redhat.com/errata/RHSA-2024:0423https://access.redhat.com/errata/RHSA-2024:0580https://access.redhat.com/security/cve/CVE-2023-34967https://bugzilla.redhat.com/show_bug.cgi?id=2222794https://www.samba.org/samba/security/CVE-2023-34967.htmlhttps://access.redhat.com/errata/RHSA-2023:6667https://access.redhat.com/errata/RHSA-2023:7139https://access.redhat.com/errata/RHSA-2024:0423https://access.redhat.com/errata/RHSA-2024:0580https://access.redhat.com/security/cve/CVE-2023-34967https://bugzilla.redhat.com/show_bug.cgi?id=2222794https://lists.fedoraproject.org/archives/list/[email protected]/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/https://lists.fedoraproject.org/archives/list/[email protected]/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/https://security.netapp.com/advisory/ntap-20230731-0010/https://www.debian.org/security/2023/dsa-5477https://www.samba.org/samba/security/CVE-2023-34967.html
2023-07-20
Published