{"id":102262,"date":"2021-11-10T21:36:39","date_gmt":"2021-11-10T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej"},"modified":"2021-11-10T21:36:39","modified_gmt":"2021-11-10T19:36:39","slug":"v-samba-ustraneno-8-opasnyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej","title":{"rendered":"In Samba sono state corrette 8 vulnerabilit\u00e0 di sicurezza gravi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Sono stati pubblicati aggiornamenti correttivi per i pacchetti Samba 4.15.2, 4.14.10 e 4.13.14 che risolvono 8 vulnerabilit\u00e0, la maggior parte delle quali possono portare a una compromissione totale del dominio Active Directory. \u00c8 interessante notare che uno dei problemi \u00e8 stato corretta dal 2016, e cinque \u2014 dal 2020; tuttavia, una correzione ha portato all'impossibilit\u00e0 di avviare winbindd quando era abilitata l'impostazione 'allow trusted domains = no' (gli sviluppatori intendono pubblicare un ulteriore aggiornamento correttivo a breve). Puoi seguire il rilascio degli aggiornamenti dei pacchetti nelle distribuzioni sulle pagine: Debian, Ubuntu, RHEL, SUSE, Fedora, Arch, FreeBSD.    <\/p>\n<p>Vulnerabilit\u00e0 risolte:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2020-25717 \u2014 a causa di una lacuna nella logica di mapping degli utenti del dominio con gli utenti del sistema locale, un utente del dominio Active Directory che ha la possibilit\u00e0 di creare nuovi account sul proprio sistema, gestito tramite ms-DS-MachineAccountQuota, poteva ottenere accesso con diritti di root su altri sistemi collegati. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/domain\/\"   title=\"un dominio\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4094\">un dominio<\/a>.\n<li class=\"l\"> CVE-2021-3738 \u2014 accesso a un'area di memoria gi\u00e0 liberata (Use after free) nell'implementazione del server RPC Samba AD DC (dsdb), che potrebbe potenzialmente portare a un aumento dei privilegi durante la manipolazione delle connessioni.\n<li class=\"l\"> CVE-2016-2124 \u2014 le connessioni client istituite utilizzando il protocollo SMB1 potrebbero essere tradotte in trasmissione delle credenziali di autenticazione in chiaro o tramite NTLM (ad esempio, per rivelare le credenziali durante attacchi MITM), anche se per l'utente o l'applicazione nelle impostazioni \u00e8 definita l'autenticazione obbligatoria tramite Kerberos.\n<li class=\"l\"> CVE-2020-25722 \u2014 nel controller di dominio Active Directory basato su Samba non venivano eseguiti i necessari controlli di accesso sui dati memorizzati, consentendo a qualsiasi utente di bypassare i controlli di autorizzazione e compromettere completamente il dominio.\n<li class=\"l\"> CVE-2020-25718 \u2014 nel controller di dominio Active Directory basato su Samba, i ticket Kerberos emessi da RODC (Read-only domain controller) non venivano isolati correttamente, il che poteva essere sfruttato per ottenere ticket amministrativi da un RODC, senza avere i permessi necessari.\n<li class=\"l\"> CVE-2020-25719 \u2014 il controller di dominio Active Directory basato su Samba non considerava sempre l'associazione tra i campi SID e PAC nei ticket Kerberos (con l'impostazione 'gensec:require_pac = true' veniva controllato solo il nome, mentre il PAC non veniva considerato), il che consentiva a un utente con il diritto di creare account sul sistema locale di spacciarsi per un altro utente nel dominio, incluso un utente privilegiato.\n<li class=\"l\"> CVE-2020-25721 \u2014 per gli utenti autenticati tramite Kerberos, non venivano sempre emessi identificatori univoci per Active Directory (objectSid), il che poteva portare a sovrapposizioni tra diversi utenti.\n<li class=\"l\"> CVE-2021-23192 \u2014 durante un attacco MITM era possibile sostituire frammenti in grandi richieste DCE\/RPC, suddivise in pi\u00f9 parti.  <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56132\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0441 2016 \u0433\u043e\u0434\u0430, \u0430 \u043f\u044f\u0442\u044c &#8212; \u0441 2020 \u0433\u043e\u0434\u0430, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u0434\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c winbindd \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &#171;allow trusted domains [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102262","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0441 2016 \u0433\u043e\u0434\u0430, \u0430 \u043f\u044f\u0442\u044c - \u0441 2020 \u0433\u043e\u0434\u0430, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u0434\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c winbindd \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &quot;allow trusted domains\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 Samba \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0441 2016 \u0433\u043e\u0434\u0430, \u0430 \u043f\u044f\u0442\u044c - \u0441 2020 \u0433\u043e\u0434\u0430, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u0434\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c winbindd \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &quot;allow trusted domains\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-11-10T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-11-10T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sono state risolte 8 vulnerabilit\u00e0 critiche in Samba | ProHoster","description":"Sono stati pubblicati aggiornamenti correttivi per i pacchetti Samba 4.15.2, 4.14.10 e 4.13.14 che risolvono 8 vulnerabilit\u00e0, la maggior parte delle quali possono portare a una compromissione totale del dominio Active Directory. \u00c8 interessante notare che uno dei problemi \u00e8 stato corretto dal 2016, e cinque dal 2020; nonostante ci\u00f2, una delle correzioni ha reso impossibile avviare winbindd in presenza della configurazione \"allow trusted domains\".","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Samba \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0441 2016 \u0433\u043e\u0434\u0430, \u0430 \u043f\u044f\u0442\u044c - \u0441 2020 \u0433\u043e\u0434\u0430, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u0434\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c winbindd \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &quot;allow trusted domains","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-10T19:36:39+00:00","article:modified_time":"2021-11-10T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-10 19:37:53","updated":"2026-03-05 11:10:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=102262"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102262\/revisions"}],"predecessor-version":[{"id":163197,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102262\/revisions\/163197"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=102262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=102262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=102262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}