Samba up to 4.15.10/4.16.5/4.17.1 Heimdal GSSAPI Library malloc buffer overflow

Summaryinfo

A vulnerability was found in Samba up to 4.15.10/4.16.5/4.17.1. It has been declared as critical. Affected by this vulnerability is the function malloc of the component Heimdal GSSAPI Library. Such manipulation leads to buffer overflow. This vulnerability is listed as CVE-2022-3437. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Samba up to 4.15.10/4.16.5/4.17.1 (File Transfer Software). It has been rated as critical. Affected by this issue is the function malloc of the component Heimdal GSSAPI Library. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

The weakness was presented 10/29/2022. The advisory is available at samba.org. This vulnerability is handled as CVE-2022-3437. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 211098 (Fedora 37 : heimdal (2022-2c77cee4b5)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.15.11, 4.16.6 or 4.17.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211098). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• File Transfer Software

Name

• Samba

Version

• 4.15.0
• 4.15.1
• 4.15.2
• 4.15.3
• 4.15.4
• 4.15.5
• 4.15.6
• 4.15.7
• 4.15.8
• 4.15.9
• 4.15.10
• 4.16.0
• 4.16.1
• 4.16.2
• 4.16.3
• 4.16.4
• 4.16.5
• 4.17.0
• 4.17.1

License

• open-source

Website

• Product: https://www.samba.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion