Vulnerabilities

TI-2023-22772 CVE-2023-42669 · GHSA-8q58-8vm2-mf3q

Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc

LOW 33

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01941 Published 2023-11-06 Partial fix · 4.17.12, 4.18.8 +6 CWE-400

TI-2023-03679 CVE-2023-3961 · GHSA-8m6h-6qw7-f6cg

Samba: smbd allows client access to unix domain sockets on the file system as root

MEDIUM 47

A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02688 Published 2023-11-03 Partial fix · 4.18.6-2.el8_9, 4.15.5-13.el8_6 +4 CWE-22

TI-2023-03787 CVE-2023-4091 · GHSA-f6jj-3gjw-frjm

Samba: smb clients can truncate files with read-only permissions

LOW 34

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes".

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01334 Published 2023-11-03 Partial fix · 4.18.6-2.el8_9, 4.15.5-13.el8_6 +4 CWE-276

Vulnerabilities

Filters

Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc

Samba: smbd allows client access to unix domain sockets on the file system as root

Samba: smb clients can truncate files with read-only permissions