Bug 886153 (CVE-2022-37966, CVE-2022-37967, CVE-2022-38023, CVE-2022-45141) – <net-fs/samba-{4.15.13, 4.16.9}: multiple vulnerabilities

• Product: Gentoo Security
• Status: IN_PROGRESS ---

[Description John Helmert III 2022-12-15 17:30:34 UTC]

"o CVE-2022-37966: This is the Samba CVE for the Windows Kerberos
                  RC4-HMAC Elevation of Privilege Vulnerability
                  disclosed by Microsoft on Nov 8 2022.

                  A Samba Active Directory DC will issue weak rc4-hmac
                  session keys for use between modern clients and servers
                  despite all modern Kerberos implementations supporting
                  the aes256-cts-hmac-sha1-96 cipher.

                  On Samba Active Directory DCs and members
                  'kerberos encryption types = legacy' would force
                  rc4-hmac as a client even if the server supports
                  aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.

https://www.samba.org/samba/security/CVE-2022-37966.html

o CVE-2022-37967: This is the Samba CVE for the Windows
                  Kerberos Elevation of Privilege Vulnerability
                  disclosed by Microsoft on Nov 8 2022.

                  A service account with the special constrained
                  delegation permission could forge a more powerful
                  ticket than the one it was presented with.

https://www.samba.org/samba/security/CVE-2022-37967.html

o CVE-2022-38023: The "RC4" protection of the NetLogon Secure channel uses the
                  same algorithms as rc4-hmac cryptography in Kerberos,
                  and so must also be assumed to be weak.

https://www.samba.org/samba/security/CVE-2022-38023.html

o CVE-2022-45141: Since the Windows Kerberos RC4-HMAC Elevation of Privilege
                  Vulnerability was disclosed by Microsoft on Nov 8 2022
                  and per RFC8429 it is assumed that rc4-hmac is weak,

                  Vulnerable Samba Active Directory DCs will issue rc4-hmac
                  encrypted tickets despite the target server supporting
                  better encryption (eg aes256-cts-hmac-sha1-96).

https://www.samba.org/samba/security/CVE-2022-45141.html"

Please bump to 4.15.13, 4.16.8, 4.15.13.

[Comment 1 Krzysztof Olędzki 2023-01-10 05:51:52 UTC]

This bug has been opened for almost a month.

Should I create a separate one requesting version bump to samba-4.15.13 & samba-4.16.8 (and perhaps 4.17.4 which may be a larger change) or is this one sufficient to track the changes?

[Comment 2 John Helmert III 2023-01-10 14:18:16 UTC]

(In reply to Krzysztof Olędzki from comment #1)
> This bug has been opened for almost a month.
> 
> Should I create a separate one requesting version bump to samba-4.15.13 &
> samba-4.16.8 (and perhaps 4.17.4 which may be a larger change) or is this
> one sufficient to track the changes?

This one is sufficient.

[Comment 3 Larry the Git Cow 2023-02-22 19:37:08 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6cdaf50845c6806cd79d92e454d197360a9bd315

commit 6cdaf50845c6806cd79d92e454d197360a9bd315
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2023-02-22 19:36:36 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2023-02-22 19:36:51 +0000

    net-fs/samba: cleanup vulnerable 4.16.7-r4
    
    Bug: https://bugs.gentoo.org/886153
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 net-fs/samba/Manifest               |   1 -
 net-fs/samba/samba-4.16.7-r4.ebuild | 368 ------------------------------------
 2 files changed, 369 deletions(-)