Bug 2245174 (CVE-2023-5568)

Summary:	CVE-2023-5568 samba: heap buffer overflow with freshness tokens in the Heimdal KDC
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abokovoy, gdeschner, rhs-smb
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.19.2	Doc Type:	If docs needed, set a value
Doc Text:	A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to cause a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2245175, 2245954
Bug Blocks:	2245172

Description Robb Gatica 2023-10-19 21:39:35 UTC

The KDC doesn’t allocate enough memory for the ‘heim_octet_string’ containing the freshness token. Potential denial of service and likely low impact. Patched in Samba 4.19.2.

Reference: 
- https://www.samba.org/samba/history/samba-4.19.2.html
- https://bugzilla.samba.org/show_bug.cgi?id=15491

Comment 1 Robb Gatica 2023-10-19 21:39:51 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2245175]

Comment 2 Robb Gatica 2023-10-19 22:37:14 UTC

Trackers need to be created, I'm continually getting errors filing trackers for RHEL and RHES.

Comment 3 Alexander Bokovoy 2023-10-20 07:47:02 UTC

This bug can be closed because none of Samba code in RHEL and Fedora is compiled against Heimdal.