Bug 2222792 (CVE-2023-3347) - CVE-2023-3347 samba: SMB2 packet signing is not enforced when "server signing = required" is set
Summary: CVE-2023-3347 samba: SMB2 packet signing is not enforced when "server signing...
Keywords:
Status: NEW
Alias: CVE-2023-3347
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2222896 2222894 2222895 2223515 2223516 2224255
Blocks: 2216374
TreeView+ depends on / blocked
 
Reported: 2023-07-13 18:08 UTC by TEJ RATHI
Modified: 2023-12-07 15:34 UTC (History)
9 users (show)

Fixed In Version: samba 4.17.10, samba 4.18.5
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4325 0 None None None 2023-07-31 08:53:17 UTC
Red Hat Product Errata RHSA-2023:4328 0 None None None 2023-07-31 09:30:20 UTC

Description TEJ RATHI 2023-07-13 18:08:09 UTC 
SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain
Controllers where SMB2 packet signing is mandatory.
Comment 3 TEJ RATHI 2023-07-20 09:23:00 UTC 
This CVE is public now - https://www.samba.org/samba/security/CVE-2023-3347.html
Comment 4 TEJ RATHI 2023-07-20 09:33:15 UTC 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 2224255]
Comment 5 errata-xmlrpc 2023-07-31 08:53:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4325 https://access.redhat.com/errata/RHSA-2023:4325
Comment 6 errata-xmlrpc 2023-07-31 09:30:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4328 https://access.redhat.com/errata/RHSA-2023:4328
Note You need to log in before you can comment on or make changes to this bug.