PT-2023-2253 · Samba+6 · Samba+6

Andrew Bartlett + 1 · Published 2023-03-29 · Updated 2025-02-13 · CVE-2023-0922

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Samba (affected versions not specified)

Description The issue is related to the Samba AD DC administration tool sending new or reset passwords over a signed-only connection when operating against a remote LDAP server. This could allow a remote attacker to obtain newly set passwords if they can observe the network traffic between samba-tool and the Samba AD DC, especially when connected using a Kerberos secured LDAP connection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

ALT-PU-2023-1618

ALT-PU-2023-1808

ALT-PU-2023-7794

ALT-PU-2024-12484

ALT-PU-2024-14683

AZL-26215

AZL-37020

BDU:2023-02011

CVE-2023-0922

ECHO-2B94-CFE2-8059

MGASA-2023-0127

OESA-2023-1231

OESA-2023-1232

OESA-2023-1233

OESA-2023-1248

OPENSUSE-SU-2024:12831-1

SUSE-SU-2023:1682-1

SUSE-SU-2023:1683-1

SUSE-SU-2023:1684-1

SUSE-SU-2023:1687-1

SUSE-SU-2023:1689-1

SUSE-SU-2023_1682-1

SUSE-SU-2023_1683-1

SUSE-SU-2023_1684-1

USN-5993-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Samba

Suse

Ubuntu

References · 67

• https://ubuntu.com/security/CVE-2023-0922 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5993-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0922 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-0922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0225 · Security Note
• https://osv.dev/vulnerability/AZL-26215 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-0922 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-0922 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1248 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1689-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1233 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12831-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1687-1 · Vendor Advisory