Blog

SAMBA+ 4.18.1, 4.17.7 and 4.16.10 have just been released. These are important security releases, please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX.

The packages address the following security related issues, which only affect the Samba AD DC and related tools:

• CVE-2023-0614 Access controlled AD LDAP attributes can be discovered.
  The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure via LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
  
  Installations with such secrets in their Samba AD should assume they have been obtained and need replacing.
   
• CVE-2023-0225 Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users.
  An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.
  
  Affects only Samba 4.17.0 and later versions.  
   
• CVE-2023-0922 Samba AD DC admin tool samba-tool sends passwords in cleartext.
  The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.

SAMBA+ 4.18.0 has just been released by SerNet's Samba team. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX are available now.

This is the first stable SAMBA+ release of the new Samba 4.18 release series. Please make sure to test thoroughly before upgrading and read the release notes carefully! The release notes, which contain information about changes and new features of the new major release, are available here: 

https://www.samba.org/samba/history/samba-4.18.0.html 

This release additionally includes patches to 

• solve an issue with restoring from snapshots (previous versions), 
• fix the directory name case normalization, when the combination of the following smb.conf options is set: 
  case sensitive = yes 
  preserve case = no 
  short preserve case = no 

With the new 4.18 release, Samba 4.17 has been turned into the "maintenance mode" and Samba 4.16 into the "security fixes only mode".  Samba 4.15 will probably not receive any updates beyond this point. The SAMBA+ 4.15 repositories will be disabled soon. Please update to a recent version of SAMBA+. 

Details on upgrading can be found in the SAMBA+ HowTo collection.

The following Linux versions will no longer be provided with up-to-date SAMBA+: 

• RHEL 6 
• CentOS 6 
• Oracle Linux 6 
• SLES 11 
• SLES 12 
• openSUSE 11.1 
• openSUSE 13.2 
• openSUSE Leap 42 

If you need SAMBA+ for any of the now unsupported operating systems, please contact us directly by mail or phone. 

The Samba team at SerNet has just released SAMBA+ 4.17.6 software packages. They are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX. 

These packages address several issues, which are listed in the release notes: 

  https://www.samba.org/samba/history/samba-4.17.6.html 

Due to some interim updates for 4.17.5 this release also contains next to other improvements patches to 

• solve an issue with restoring from snapshots (previous versions), 
• fix the directory name case normalization, when the combination of the following smb.conf options is set: 
  case sensitive = yes 
  preserve case = no 
  short preserve case = no 

SAMBA+ 4.17.5 software packages have just been released by SerNet. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX are available now.

These packages address several issues, which are listed in the release notes:

• https://www.samba.org/samba/history/samba-4.17.5.html

SAMBA+ 4.17.4, 4.16.8 and 4.15.13 have just been released. These are important security releases, please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX.

Please note that there are several important behavior changes included in this releases, which may cause compatibility problems interacting with system still expecting the former behavior. Especially systems older than Windows 7, Windows 2008R2 and Samba 4.0 are affected here. Systems like NetApp ONTAP may also be affected. Please read the release notes and advisories carefully:

• Release Notes for Samba 4.17.4
• Release Notes for Samba 4.16.8
• Release Notes for Samba 4.15.13

The packages address the following security related issues:

• CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers
  This is the Samba CVE for the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.
  
  A Samba Active Directory DC will issue weak rc4-hmac session keys for use between modern clients and servers despite all modern Kerberos implementations supporting the aes256-cts-hmac-sha1-96 cipher.
  
  On Samba Active Directory DCs and members 'kerberos encryption types = legacy' would force rc4-hmac as a client even if the server supports aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
   
• CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC
  This is the Samba CVE for the Windows Kerberos Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.
  
  A service account with the special constrained delegation permission could forge a more powerful ticket than the one it was presented with.
   
• CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided
  The "RC4" protection of the NetLogon Secure channel uses the same algorithms as rc4-hmac cryptography in Kerberos, and so must also be assumed to be weak.

The SAMBA+ 4.15.13 packages additionally addresses:

• CVE-2022-45141 Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets
  Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak.
  
  Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (e.g. aes256-cts-hmac-sha1-96).