Hide navigation sidebar
Hide table of contents sidebar
Skip to content
SAMBA 4.24
Back to top
View this page
Toggle table of contents sidebar

# Avis de sécurité

Les avis de sécurité pour Samba sont répertoriés ci-dessous.

Avertissement

Avant de mettre à jour samba, merci de lire attentivement tous les avis de sécurité. Certains changements peuvent casser la production.

## Samba 4.19.3 Security Releases

    This is the latest stable release of the Samba 4.19 release series.
    It contains the security-relevant bug CVE-2018-14628:

    Wrong ntSecurityDescriptor values for "CN=Deleted Objects"
    allow read of object tombstones over LDAP
    (Administrator action required!)
    https://www.samba.org/samba/security/CVE-2018-14628.html

## Samba 4.19.1, 4.18.8 and 4.17.12 Security Releases

    o CVE-2023-3961:  Unsanitized pipe names allow SMB clients to connect as root to
                      existing unix domain sockets on the file system.
                      https://www.samba.org/samba/security/CVE-2023-3961.html

    o CVE-2023-4091:  SMB client can truncate files to 0 bytes by opening files with
                      OVERWRITE disposition when using the acl_xattr Samba VFS
                      module with the smb.conf setting
                      "acl_xattr:ignore system acls = yes"
                      https://www.samba.org/samba/security/CVE-2023-4091.html

    o CVE-2023-4154:  An RODC and a user with the GET_CHANGES right can view all
                      attributes, including secrets and passwords.  Additionally,
                      the access check fails open on error conditions.
                      https://www.samba.org/samba/security/CVE-2023-4154.html

    o CVE-2023-42669: Calls to the rpcecho server on the AD DC can request that the
                     server block for a user-defined amount of time, denying
                      service.
                      https://www.samba.org/samba/security/CVE-2023-42669.html

    o CVE-2023-42670: Samba can be made to start multiple incompatible RPC
                      listeners, disrupting service on the AD DC.
                      https://www.samba.org/samba/security/CVE-2023-42670.html