Back to bug 2222791

Who When What Removed Added
TEJ RATHI 2023-07-13 18:08:00 UTC CC security-response-team
TEJ RATHI 2023-07-13 18:09:01 UTC CC abokovoy, anoopcs, asn, dkarpele, nobody, pfilipen, sbose
TEJ RATHI 2023-07-13 18:13:19 UTC Blocks 2216374
TEJ RATHI 2023-07-14 11:42:10 UTC Depends On 2222896, 2222894, 2222895
Guilherme de Almeida Suckevicz 2023-07-17 14:02:21 UTC Blocks 2135524
TEJ RATHI 2023-07-17 14:34:57 UTC Deadline 2023-07-19
TEJ RATHI 2023-07-19 14:52:27 UTC Fixed In Version samba 4.16.11, samba 4.17.10, samba 4.18.5
TEJ RATHI 2023-07-20 04:35:12 UTC Doc Text An out-of-bounds read vulnerability was discovered in Samba's due to insufficient length checks in winbindd_pam_auth_crap.c. When doing NTLM authentication, the client sends replies to cryptographic challenges back to the server. These replies have variable length, which winbind fails to check the lan manager response length. When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it.
TEJ RATHI 2023-07-20 09:24:17 UTC Group security, qe_staff
CC rhs-smb
Summary EMBARGOED CVE-2022-2127 samba: out-of-bounds read in winbind AUTH_CRAP CVE-2022-2127 samba: out-of-bounds read in winbind AUTH_CRAP
Deadline 2023-07-19
TEJ RATHI 2023-07-20 09:33:10 UTC Depends On 2224254
RaTasha Tillery-Smith 2023-07-20 13:34:27 UTC Doc Text An out-of-bounds read vulnerability was discovered in Samba's due to insufficient length checks in winbindd_pam_auth_crap.c. When doing NTLM authentication, the client sends replies to cryptographic challenges back to the server. These replies have variable length, which winbind fails to check the lan manager response length. When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it. An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.

Back to bug 2222791