CVE-2022-2127

MEDIUM

5.9

Descricao

An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.

Detalhes CVE

Pontuacao CVSS v3.15.9

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado7/20/2023

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

debian:debian_linuxfedoraproject:fedoraredhat:enterprise_linuxsamba:samba

Fraquezas (CWE)

CWE-125CWE-125

Referencias

https://access.redhat.com/errata/RHSA-2023:6667(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2023:7139(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:0423(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:0580(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2022-2127(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2222791(secalert@redhat.com)

https://www.samba.org/samba/security/CVE-2022-2127.html(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2023:6667(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2023:7139(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2024:0423(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2024:0580(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/security/cve/CVE-2022-2127(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=2222791(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20230731-0010/(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5477(af854a3a-2127-422b-91ae-364da2661108)

https://www.samba.org/samba/security/CVE-2022-2127.html(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.