SUSE-SU-2023:0014-1

HIGH8.1

Security update for samba

Published Jan 2, 2023

Modified 3 years ago

Fix available

Details

Description of the patch:

This update for samba fixes the following issues:

Update to 4.15.13

CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers (bsc#1205385).
CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC (bsc#1205386).
CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (bsc#1206504).
Fixed issue with bind start up (bsc#1205946).

Affected Packages(26 packages)

libsamba-policy-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

libsamba-policy-python3-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

libsamba-policy0-python3

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

samba

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

samba-ad-dc-libs

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

samba-ad-dc-libs-32bit

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

samba-ceph

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

samba-client

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

samba-client-32bit

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

samba-client-libs

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

4.15.13+git.540.fab3b2a46c6-150300.3.46.1

References

https://bugzilla.suse.com/1205385

https://bugzilla.suse.com/1205386

https://bugzilla.suse.com/1205946

https://bugzilla.suse.com/1206504

https://lists.suse.com/pipermail/sle-security-updates/2023-January/013414.html

https://www.suse.com/security/cve/CVE-2022-37966/

https://www.suse.com/security/cve/CVE-2022-37967/

https://www.suse.com/security/cve/CVE-2022-38023/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2023/suse-su-20230014-1/

CVSS Analysis

CVSS v3.1

8.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Upstream

CVE-2022-37966 CVE-2022-37967 CVE-2022-38023

Ecosystems(17)

SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15 SP3 SUSE Linux Enterprise High Availability Extension 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS

Timeline

PublishedJan 2, 2023

ModifiedJan 2, 2023

SUSE-SU-2023:0014-1 | Mondoo Vulnerability Intelligence