Headline
Ubuntu Security Notice USN-5993-1
Ubuntu Security Notice 5993-1 - Demi Marie Obenour discovered that the Samba LDAP server incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive information. Andrew Bartlett discovered that the Samba AD DC admin tool incorrectly sent passwords in cleartext. A remote attacker could possibly use this issue to obtain sensitive information.
==========================================================================
Ubuntu Security Notice USN-5993-1
April 03, 2023
samba vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Samba could be made to expose sensitive information over the network.
Software Description:
- samba: SMB/CIFS file, print, and login server for Unix
Details:
Demi Marie Obenour discovered that the Samba LDAP server incorrectly
handled certain confidential attribute values. A remote authenticated
attacker could possibly use this issue to obtain certain sensitive
information. (CVE-2023-0614)
Andrew Bartlett discovered that the Samba AD DC admin tool incorrectly
sent passwords in cleartext. A remote attacker could possibly use this
issue to obtain sensitive information. (CVE-2023-0922)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
samba 2:4.16.8+dfsg-0ubuntu1.1
Ubuntu 22.04 LTS:
samba 2:4.15.13+dfsg-0ubuntu1.1
Ubuntu 20.04 LTS:
samba 2:4.15.13+dfsg-0ubuntu0.20.04.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5993-1
CVE-2023-0614, CVE-2023-0922
Package Information:
https://launchpad.net/ubuntu/+source/samba/2:4.16.8+dfsg-0ubuntu1.1
https://launchpad.net/ubuntu/+source/samba/2:4.15.13+dfsg-0ubuntu1.1
https://launchpad.net/ubuntu/+source/samba/2:4.15.13+dfsg-0ubuntu0.20.04.2
Related news
Gentoo Linux Security Advisory 202309-6 - Multiple vulnerabilities have been discovered in Samba, the worst of which could result in root remote code execution. Versions greater than or equal to 4.18.4 are affected.
The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.
The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
Ubuntu Security Notice 5992-1 - Demi Marie Obenour discovered that ldb, when used with Samba, incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive information.