Debian Samba vulnerabilities

CVE-2021-20254 [MEDIUM] CVE-2021-20254: samba - A flaw was found in samba. The Samba smbd file server must map Windows group ide... A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the p

CVE-2021-3671 [MEDIUM] CVE-2021-3671: heimdal - A null pointer de-reference was found in the way samba kerberos server handled m... A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server. Scope: local bookworm: resolved (fixed in 7.7.0+dfsg-3) bullseye: resolved (fixed in 7.7.0+dfsg-2+deb11u2) forky: resolved (fixed in 7.7.0+dfsg-3) sid: resolve

CVE-2021-20316 [MEDIUM] CVE-2021-20316: samba - A flaw was found in the way Samba handled file/directory metadata. This flaw all... A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share. Scope: local bookworm: resolved (fixed in 2:4.16.0+dfsg-2) bullseye: open forky: resolved (fixed in 2:4.16.0+dfsg-2) sid: resolved (fixed in 2:4.16.0+dfsg-2) t

CVE-2021-43566 [LOW] CVE-2021-43566: samba - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client usin... All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed. Scope: local bookworm: resolved (fixed in 2:4.16.

CVE-2020-25718 [HIGH] CVE-2020-25718: samba - A flaw was found in the way samba, as an Active Directory Domain Controller, is ... A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets. Scope: local bookworm: resolved (fixed in 2:4.13.14+dfsg-1) bullseye: resolved (fixed in 2:4.13.13+dfsg-1~deb11u2) forky: resolved (fixed in 2:4.13.14+dfsg-1) sid: resolved (fixe

CVE-2020-10745 [HIGH] CVE-2020-10745: samba - A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before... A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fi

CVE-2020-25722 [HIGH] CVE-2020-25722: samba - Multiple flaws were found in the way samba AD DC implemented access and conforma... Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise. Scope: local bookworm: resolved (fixed in 2:4.13.14+dfsg-1) bullseye: resolved (fixed in 2:4.13.13+dfsg-1~deb11u2) forky: resolved (fixed in 2:4.13.14+dfsg-1) sid: resolved (fixed in 2:4.13.14+df

CVE-2020-25717 [HIGH] CVE-2020-25717: samba - A flaw was found in the way Samba maps domain users to local users. An authentic... A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. Scope: local bookworm: resolved (fixed in 2:4.13.14+dfsg-1) bullseye: resolved (fixed in 2:4.13.13+dfsg-1~deb11u2) forky: resolved (fixed in 2:4.13.14+dfsg-1) sid: resolved (fixed in 2:4.13.14+dfsg-1) trixie: resolve

CVE-2020-25719 [HIGH] CVE-2020-25719: samba - A flaw was found in the way Samba, as an Active Directory Domain Controller, imp... A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise. Scope: local bookworm: resolved (fixe

CVE-2020-27840 [HIGH] CVE-2020-27840: ldb - A flaw was found in samba. Spaces used in a string around a domain name (DN), wh... A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability. Scope: local bullseye: resolved (fixed in 2:2.2.0-3.1)

CVE-2020-10704 [HIGH] CVE-2020-10704: samba - A flaw was found when using samba as an Active Directory Domain Controller. Due ... A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before

CVE-2020-25721 [HIGH] CVE-2020-25721: samba - Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Sam... Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets. Scope: local bookworm: resolved (fixed in 2:4.13.14+dfsg-1) bullseye: resolved (fixed in 2:4.13.13+dfsg-1~deb11u2) forky: resolved (fixed in 2:4.13.14+dfsg-1) sid: reso

CVE-2020-25720 [HIGH] CVE-2020-25720: samba - A vulnerability was found in Samba where a delegated administrator with permissi... A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the ti

CVE-2020-14303 [HIGH] CVE-2020-14303: samba - A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, b... A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash. Scope: local bookworm: resolved (fixed in 2:4.12.5+dfsg-1) bullseye: resolved (fixed in 2:4.12.5+dfsg-1) forky: resolved (fixed in 2:4.12.5+dfsg-1) sid: resolved (fixed in 2:4.1

CVE-2020-10760 [MEDIUM] CVE-2020-10760: samba - A use-after-free flaw was found in all samba LDAP server versions before 4.10.17... A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba. Scope: local bookworm: resolved (fixed in 2:4.12.5+dfsg-1) bullseye: resolved (fixed in 2:4.12.5+dfsg-1) forky: resolved (fixed in 2:4.12.5+dfsg-1) sid: resolved (fixed in

CVE-2020-14323 [MEDIUM] CVE-2020-14323: samba - A null pointer dereference flaw was found in samba's Winbind service in versions... A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service. Scope: local bookworm: resolved (fixed in 2:4.13.2+dfsg-2) bullseye: resolved (fixed in 2:4.13.2+dfsg-2) forky: resolved (fixed in 2:4.13.2+dfsg-2) s

CVE-2020-14383 [MEDIUM] CVE-2020-14383: samba - A flaw was found in samba's DNS server. An authenticated user could use this fla... A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to op

CVE-2020-1472 [MEDIUM] CVE-2020-1472: samba - An elevation of privilege vulnerability exists when an attacker establishes a vu... An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated

CVE-2020-14318 [MEDIUM] CVE-2020-14318: samba - A flaw was found in the way samba handled file and directory permissions. An aut... A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. Scope: local bookworm: resolved (fixed in 2:4.13.2+dfsg-2) bullseye: resolved (fixed in 2:4.13.2+dfsg-2) forky: resolved (fixed in 2:4.13.2+d

CVE-2020-10700 [MEDIUM] CVE-2020-10700: samba - A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Pa... A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2. Scope: local bookworm: resolved (fixed in 2:4.12.3+dfsg-2) bullse