SUSE SLES12 Security Update : samba (SUSE-SU-2022:0323-1)

high Nessus Plugin ID 157373

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0323-1 advisory.

- Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.
(CVE-2020-25721)

- An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc. (CVE-2020-29361)

- A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share. (CVE-2021-20316)

- All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed. (CVE-2021-43566)

- All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
(CVE-2021-44141)

- The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

- The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity. (CVE-2022-0336)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1089938

https://bugzilla.suse.com/1139519

https://bugzilla.suse.com/1158916

https://bugzilla.suse.com/1180064

https://bugzilla.suse.com/1182058

https://bugzilla.suse.com/1191227

https://bugzilla.suse.com/1192505

https://bugzilla.suse.com/1192684

https://bugzilla.suse.com/1193533

https://bugzilla.suse.com/1193690

https://bugzilla.suse.com/1194859

https://bugzilla.suse.com/1195048

https://www.suse.com/security/cve/CVE-2020-25721

https://www.suse.com/security/cve/CVE-2020-29361

https://www.suse.com/security/cve/CVE-2021-20316

https://www.suse.com/security/cve/CVE-2021-43566

https://www.suse.com/security/cve/CVE-2021-44141

https://www.suse.com/security/cve/CVE-2021-44142

https://www.suse.com/security/cve/CVE-2022-0336

http://www.nessus.org/u?f1fe4996

Plugin Details

Severity: High

ID: 157373

File Name: suse_SU-2022-0323-1.nasl

Version: 1.9

Type: local

Agent: unix

Published: 2/4/2022

Updated: 7/13/2023

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2021-44142

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2022-0336

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:apache2-mod_apparmor, p-cpe:/a:novell:suse_linux:apparmor-docs, p-cpe:/a:novell:suse_linux:apparmor-parser, p-cpe:/a:novell:suse_linux:apparmor-profiles, p-cpe:/a:novell:suse_linux:apparmor-utils, p-cpe:/a:novell:suse_linux:ca-certificates, p-cpe:/a:novell:suse_linux:ctdb, p-cpe:/a:novell:suse_linux:libapparmor-devel, p-cpe:/a:novell:suse_linux:libapparmor1, p-cpe:/a:novell:suse_linux:libapparmor1-32bit, p-cpe:/a:novell:suse_linux:libgnutls30, p-cpe:/a:novell:suse_linux:libgnutls30-32bit, p-cpe:/a:novell:suse_linux:libhogweed4, p-cpe:/a:novell:suse_linux:libhogweed4-32bit, p-cpe:/a:novell:suse_linux:libipa_hbac-devel, p-cpe:/a:novell:suse_linux:libipa_hbac0, p-cpe:/a:novell:suse_linux:libnettle6, p-cpe:/a:novell:suse_linux:libnettle6-32bit, p-cpe:/a:novell:suse_linux:libp11-kit0, p-cpe:/a:novell:suse_linux:libp11-kit0-32bit, p-cpe:/a:novell:suse_linux:libsamba-policy-devel, p-cpe:/a:novell:suse_linux:libsamba-policy-python3-devel, p-cpe:/a:novell:suse_linux:libsamba-policy0-python3, p-cpe:/a:novell:suse_linux:libsamba-policy0-python3-32bit, p-cpe:/a:novell:suse_linux:libsss_certmap0, p-cpe:/a:novell:suse_linux:libsss_idmap-devel, p-cpe:/a:novell:suse_linux:libsss_idmap0, p-cpe:/a:novell:suse_linux:libsss_nss_idmap-devel, p-cpe:/a:novell:suse_linux:libsss_nss_idmap0, p-cpe:/a:novell:suse_linux:libsss_simpleifp0, p-cpe:/a:novell:suse_linux:p11-kit, p-cpe:/a:novell:suse_linux:p11-kit-32bit, p-cpe:/a:novell:suse_linux:p11-kit-devel, p-cpe:/a:novell:suse_linux:p11-kit-nss-trust, p-cpe:/a:novell:suse_linux:p11-kit-tools, p-cpe:/a:novell:suse_linux:pam_apparmor, p-cpe:/a:novell:suse_linux:pam_apparmor-32bit, p-cpe:/a:novell:suse_linux:perl-apparmor, p-cpe:/a:novell:suse_linux:python-sssd-config, p-cpe:/a:novell:suse_linux:samba, p-cpe:/a:novell:suse_linux:samba-client, p-cpe:/a:novell:suse_linux:samba-client-32bit, p-cpe:/a:novell:suse_linux:samba-client-libs, p-cpe:/a:novell:suse_linux:samba-client-libs-32bit, p-cpe:/a:novell:suse_linux:samba-devel, p-cpe:/a:novell:suse_linux:samba-devel-32bit, p-cpe:/a:novell:suse_linux:samba-doc, p-cpe:/a:novell:suse_linux:samba-ldb-ldap, p-cpe:/a:novell:suse_linux:samba-libs, p-cpe:/a:novell:suse_linux:samba-libs-32bit, p-cpe:/a:novell:suse_linux:samba-libs-python3, p-cpe:/a:novell:suse_linux:samba-libs-python3-32bit, p-cpe:/a:novell:suse_linux:samba-python3, p-cpe:/a:novell:suse_linux:samba-tool, p-cpe:/a:novell:suse_linux:samba-winbind, p-cpe:/a:novell:suse_linux:samba-winbind-libs, p-cpe:/a:novell:suse_linux:samba-winbind-libs-32bit, p-cpe:/a:novell:suse_linux:sssd, p-cpe:/a:novell:suse_linux:sssd-ad, p-cpe:/a:novell:suse_linux:sssd-common, p-cpe:/a:novell:suse_linux:sssd-dbus, p-cpe:/a:novell:suse_linux:sssd-ipa, p-cpe:/a:novell:suse_linux:sssd-krb5, p-cpe:/a:novell:suse_linux:sssd-krb5-common, p-cpe:/a:novell:suse_linux:sssd-ldap, p-cpe:/a:novell:suse_linux:sssd-proxy, p-cpe:/a:novell:suse_linux:sssd-tools, p-cpe:/a:novell:suse_linux:yast2-samba-client, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/14/2022

Vulnerability Publication Date: 12/16/2020

Reference Information

CVE: CVE-2020-25721, CVE-2020-29361, CVE-2021-20316, CVE-2021-43566, CVE-2021-44141, CVE-2021-44142, CVE-2022-0336

IAVA: 2022-A-0020-S, 2022-A-0054-S

SuSE: SUSE-SU-2022:0323-1