{"id":104724,"date":"2022-07-28T15:36:38","date_gmt":"2022-07-28T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-samba-pozvolyayushhaya-pomenyat-parol-lyubomu-polzovatelyu"},"modified":"2022-07-28T15:36:38","modified_gmt":"2022-07-28T13:36:38","slug":"uyazvimost-v-samba-pozvolyayushhaya-pomenyat-parol-lyubomu-polzovatelyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-pozvolyayushhaya-pomenyat-parol-lyubomu-polzovatelyu","title":{"rendered":"Haavatavus Sambas, mis v\u00f5imaldab igal kasutajal parooli vahetada","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Avaldatud on Samba 4.16.4, 4.15.9 ja 4.14.14 pakettide korrektsiooniaugud, mis parandavad 5 haavatavust. Pakettide v\u00e4rskenduste v\u00e4ljalaskmist erinevates distributsioonides saab j\u00e4lgida lehtedel: Debian, Ubuntu, RHEL, SUSE, Arch, FreeBSD.    <\/p>\n<p>K\u00f5ige ohtlikum haavatavus (CVE-2022-32744) v\u00f5imaldab Active Directory domeeni kasutajatel muuta mis tahes kasutaja parooli, sealhulgas administraatori parooli, ja saada t\u00e4ielik kontroll domeeni \u00fcle. Probleem tuleneb sellest, et KDC aktsepteerib kpasswd-p\u00e4ringuid, mis on kr\u00fcpteeritud mis tahes tuntud v\u00f5tmega.     <\/p>\n<p>R\u00fcndaja, kellel on juurdep\u00e4\u00e4s  <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/domain\/\"   title=\"domeeniga\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1234\">domeeniga<\/a>, v\u00f5ib saata vale parooli seadmise p\u00e4ringu teise kasutaja nimel, kr\u00fcptides selle oma v\u00f5tmega, ning KDC t\u00f6\u00f6tleb seda ilma konto v\u00f5tme vastavust kontrollimata. Sealhulgas v\u00f5ivad vale p\u00e4ringute saatmiseks kasutada domeenikontrollerite lugemisre\u017eiimis (RODC) v\u00f5tmeid, millel pole \u00f5igusi paroolide muutmiseks. Kaitsemeetmena v\u00f5ib kpasswd protokolli toe v\u00e4lja l\u00fclitada, lisades smb.conf faili rea &#171;kpasswd port = 0&#187;.    <\/p>\n<p>Teised haavatavused:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-32746 &#8212; Active Directory kasutajad saavad spetsiaalselt vormindatud LDAP-p\u00e4ringute &#171;add&#187; v\u00f5i &#171;modify&#187; saatmise kaudu algatada p\u00e4rast vabastamist m\u00e4lu juurdep\u00e4\u00e4su (use-after-free) serveri protsessis. Probleem tuleneb sellest, et logimise moodul p\u00e4\u00e4seb ligip\u00e4\u00e4su LDAP-s\u00f5numi sisule p\u00e4rast seda, kui andmebaasi moodul vabastab s\u00f5numiks etten\u00e4htud m\u00e4lu. R\u00fcnnaku sooritamiseks on vajalik ligip\u00e4\u00e4s m\u00f5nede erivolitustega atribuutide lisamiseks v\u00f5i muutmiseks, nagu n\u00e4iteks userAccountControl.\n<li class=\"l\"> CVE-2022-2031 &#8212; Active Directory kasutajad saavad m\u00f6\u00f6duda teatud piirangutest domeenikontrolleris. KDC ja kpasswd teenus saavad omavahel dekr\u00fcpteerida piletid, kuna nad kasutavad \u00fcht ja sama v\u00f5tmete ning kontode komplekti. Seega saab parooli muutmist taotlenud kasutaja saadud piletit kasutada juurdep\u00e4\u00e4suks teistele teenustele.\n<li class=\"l\"> CVE-2022-32745 &#8212; Active Directory kasutajad v\u00f5ivad saata LDAP-p\u00e4ringute &#171;add&#187; v\u00f5i &#171;modify&#187; kaudu, mis viivad serveri protsessi ootamatule l\u00f5petamisele, kasutades mitteinihialiseeritud andmeid.\n<li class=\"l\"> CVE-2022-32742 &#8212; teabe leke m\u00e4lu sisust <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\"   title=\"serverid\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3841\">serverid<\/a> SMB1 protokolli manipuleerimise kaudu. SMB1 klient, kellel on kirjutamis\u00f5igus jagatud salvestuses, v\u00f5ib luua tingimused serveri protsessi m\u00e4lu sisu fragmente faili kirjutamiseks v\u00f5i printimiseks saatmiseks. R\u00fcnnak viiakse l\u00e4bi ebat\u00e4pset vahemikku n\u00e4itava &#171;write&#187; p\u00e4ringu saatmise teel. Probleem puudutab ainult Samba harusid kuni 4.11 (4.11 harus on SMB1 tugi vaikimisi keelatud).                 <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57565\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.16.4, 4.15.9 \u0438 4.14.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412\u044b\u043f\u0443\u0441\u043a \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, RHEL, SUSE, Arch, FreeBSD. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-32744) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0434\u043e\u043c\u0435\u043d\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104724","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.16.4, 4.15.9 \u0438 4.14.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-pozvolyayushhaya-pomenyat-parol-lyubomu-polzovatelyu\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Samba, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.16.4, 4.15.9 \u0438 4.14.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-pozvolyayushhaya-pomenyat-parol-lyubomu-polzovatelyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-07-28T13:36:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-07-28T13:36:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Haavatavus Sambas, mis v\u00f5imaldab muuta parooli igal kasutajal | ProHoster","description":"On avaldatud paranduste versioonid Samba paketist 4.16.4, 4.15.9 ja 4.14.14, millega on k\u00f5rvaldatud 5 haavatavust.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-pozvolyayushhaya-pomenyat-parol-lyubomu-polzovatelyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Samba, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.16.4, 4.15.9 \u0438 4.14.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-pozvolyayushhaya-pomenyat-parol-lyubomu-polzovatelyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-07-28T13:36:38+00:00","article:modified_time":"2022-07-28T13:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104724","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-07-28 13:37:27","updated":"2026-02-22 15:30:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=104724"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104724\/revisions"}],"predecessor-version":[{"id":162369,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104724\/revisions\/162369"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=104724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=104724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=104724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}