Attachment 17917 Details for Bug 15341 – Advisory v2

Advisory v2

CVE-bug15341-security_advisory.txt (text/plain), 2.27 KB, created by Ralph Böhme on 2023-06-14 15:13:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ralph Böhme

Created: 2023-06-14 15:13:43 UTC

Size: 2.27 KB

patch

obsolete

>
>TODO: $VERSION
>
>===========================================================
>== Subject:     Samba Spotlight mdssvc RPC Request Type
>==              Confusion Denial-of-Service Vulnerability
>==
>== CVE ID#:     CVE-2023-34967
>==
>== Versions:    All versions of Samba prior to $VERSION
>==
>== Summary:     Missing type validation in Samba's mdssvc
>==              RPC service for Spotlight can be used by
>==              an unauthenticated attacker to trigger
>==              a process crash in a shared RPC mdssvc
>==              worker process.
>===========================================================
>
>===========
>Description
>===========
>
>When parsing Spotlight mdssvc RPC packets, one encoded data
>structure is a key-value style dictionary where the keys
>are character strings and the values can be any of the
>supported types in the mdssvc protocol. Due to a lack of
>type checking in callers of the function
>dalloc_value_for_key(), which returns the object associated
>with a key, a caller may trigger a crash in
>talloc_get_size() when talloc detects that the passed in
>pointer is not a valid talloc pointer.
>
>As RPC worker processes are shared among multiple client
>connections, a malicious client can crash the worker process
>affecting all other clients that are also served by this worker.
>
>==================
>Patch Availability
>==================
>
>Patches addressing both these issues have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba $VERSIONS have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>CVSS 3.0: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3)
>
>==========
>Workaround
>==========
>
>As a possible workaround disable Spotlight by removing all
>configuration stanzas that enable Spotlight ("spotlight =
>yes|true").
>
>=======
>Credits
>=======
>
>Originally reported by Florent Saudel and Arnaud Gatignolof
>the Thalium team working with Trend Micro Zero Day
>Initiative.
>
>Patches provided by Ralph Boehme of SerNet and the Samba
>team.
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Flags:

jra: review+

Actions: View

Attachments on bug 15341: 17841 | 17903 | 17911 | 17917 | 17920 | 17943 | 17944 | 17951