{"id":102262,"date":"2021-11-10T21:36:39","date_gmt":"2021-11-10T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej"},"modified":"2021-11-10T21:36:39","modified_gmt":"2021-11-10T19:36:39","slug":"v-samba-ustraneno-8-opasnyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej","title":{"rendered":"Se han corregido 8 vulnerabilidades cr\u00edticas en Samba","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Se han publicado lanzamientos de correcci\u00f3n para los paquetes Samba 4.15.2, 4.14.10 y 4.13.14, que resuelven 8 vulnerabilidades, la mayor\u00eda de las cuales pueden llevar a la completa compromisi\u00f3n del dominio de Active Directory. Es notable que uno de los problemas se estuvo corrigiendo desde 2016, y cinco desde 2020; sin embargo, una de las correcciones result\u00f3 en la imposibilidad de iniciar winbindd cuando se ten\u00eda configurada la opci\u00f3n 'allow trusted domains = no' (los desarrolladores tienen la intenci\u00f3n de publicar pronto otra actualizaci\u00f3n con una soluci\u00f3n). El lanzamiento de actualizaciones de paquetes en las distribuciones se puede seguir en las p\u00e1ginas: Debian, Ubuntu, RHEL, SUSE, Fedora, Arch, FreeBSD.    <\/p>\n<p>Vulnerabilidades corregidas:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2020-25717 \u2014 debido a un fallo en la l\u00f3gica de mapeo de usuarios del dominio a usuarios del sistema local, un usuario del dominio Active Directory que tiene la capacidad de crear nuevas cuentas en su sistema, gestionadas a trav\u00e9s de ms-DS-MachineAccountQuota, podr\u00eda obtener acceso con privilegios de root en otros sistemas que forman parte de <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/es\/domain\/\"   title=\"nombre de dominio\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4094\">nombre de dominio<\/a>.\n<li class=\"l\"> CVE-2021-3738 \u2014 acceso a una regi\u00f3n de memoria ya liberada (Use after free) en la implementaci\u00f3n del servidor RPC de Samba AD DC (dsdb), lo que potencialmente podr\u00eda llevar a un aumento de privilegios al manipular la configuraci\u00f3n de conexiones.\n<li class=\"l\"> CVE-2016-2124 \u2014 las conexiones de clientes establecidas utilizando el protocolo SMB1 podr\u00edan ser redirigidas para transmitir par\u00e1metros de autenticaci\u00f3n en texto claro o a trav\u00e9s de NTLM (por ejemplo, para descubrir credenciales durante ataques MITM), incluso si se ha configurado en los ajustes que la autenticaci\u00f3n a trav\u00e9s de Kerberos es obligatoria para el usuario o la aplicaci\u00f3n.\n<li class=\"l\"> CVE-2020-25722 \u2014 en el controlador de dominio Active Directory basado en Samba no se realizaban las verificaciones adecuadas de acceso a los datos almacenados, permitiendo a cualquier usuario eludir las comprobaciones de autoridad y comprometer completamente el dominio.\n<li class=\"l\"> CVE-2020-25718 \u2014 en el controlador de dominio Active Directory basado en Samba, los tickets de Kerberos emitidos por RODC (Controlador de dominio solo de lectura) no estaban siendo aislados correctamente, lo que pod\u00eda ser utilizado para obtener tickets de administrador de RODC sin tener la autoridad para ello.\n<li class=\"l\"> CVE-2020-25719 \u2014 el controlador de dominio Active Directory basado en Samba no siempre ten\u00eda en cuenta la combinaci\u00f3n de los campos SID y PAC en los tickets de Kerberos (al configurar 'gensec:require_pac = true' solo se verificaba el nombre y no se ten\u00eda en cuenta el PAC), lo que permit\u00eda a un usuario con derechos para crear cuentas en el sistema local hacerse pasar por otro usuario en el dominio, incluido un privilegiado.\n<li class=\"l\"> CVE-2020-25721 \u2014 para los usuarios autenticados con Kerberos, no siempre se emit\u00edan identificadores \u00fanicos para Active Directory (objectSid), lo que podr\u00eda provocar la superposici\u00f3n de un usuario con otro.\n<li class=\"l\"> CVE-2021-23192 \u2014 durante un ataque MITM, hab\u00eda la posibilidad de reemplazar fragmentos en grandes solicitudes DCE\/RPC que se divid\u00edan en varias partes.  <\/ul>\n<p>Fuente: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56132\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0441 2016 \u0433\u043e\u0434\u0430, \u0430 \u043f\u044f\u0442\u044c &#8212; \u0441 2020 \u0433\u043e\u0434\u0430, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u0434\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c winbindd \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &#171;allow trusted domains [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102262","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/es\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"es_ES\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 Samba \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/es\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-11-10T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-11-10T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Se han solucionado 8 vulnerabilidades cr\u00edticas en Samba | ProHoster","description":"Se han publicado versiones corregidas del paquete Samba 4.15.2, 4.14.10 y 4.13.14 que solucionan 8 vulnerabilidades, la mayor\u00eda de las cuales podr\u00edan llevar a una completa compromisi\u00f3n del dominio Active Directory.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Samba \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-10T19:36:39+00:00","article:modified_time":"2021-11-10T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-10 19:37:53","updated":"2026-03-05 11:10:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=102262"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102262\/revisions"}],"predecessor-version":[{"id":163197,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102262\/revisions\/163197"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=102262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=102262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=102262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}