{"id":102262,"date":"2021-11-10T21:36:39","date_gmt":"2021-11-10T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-samba-ustraneno-8-opasnyh-uyazvimostej"},"modified":"2021-11-10T21:36:39","modified_gmt":"2021-11-10T19:36:39","slug":"v-samba-ustraneno-8-opasnyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej","title":{"rendered":"\u00cen Samba au fost remediate 8 vulnerabilit\u0103\u021bi critice.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Au fost publicate actualiz\u0103rile corective pentru pachetele Samba 4.15.2, 4.14.10 \u0219i 4.13.14, care remediaz\u0103 8 vulnerabilit\u0103\u021bi, majoritatea dintre ele put\u00e2nd conduce la compromiterea total\u0103 a domeniului Active Directory. Este notabil faptul c\u0103 una dintre probleme a fost corectat\u0103 din 2016, iar cinci \u2014 din 2020, totu\u0219i o corectare a dus la imposibilitatea de a lansa winbindd \u00een prezen\u021ba configura\u021biei \u201eallow trusted domains = no\u201d (dezvoltatorii inten\u021bioneaz\u0103 s\u0103 publice rapid o alt\u0103 actualizare cu aceast\u0103 corectare). Lansarea actualiz\u0103rilor pachetelor \u00een distribu\u021bii poate fi urm\u0103rit\u0103 pe paginile: Debian, Ubuntu, RHEL, SUSE, Fedora, Arch, FreeBSD.    <\/p>\n<p>Vulnerabilit\u0103\u021bile remediate:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2020-25717 \u2014 din cauza unei deficien\u021be \u00een logica de mapare a utilizatorilor domeniului cu utilizatorii sistemului local, un utilizator al domeniului Active Directory, care are posibilitatea de a crea noi conturi pe propriul sistem, gestionate prin ms-DS-MachineAccountQuota, putea ob\u021bine acces cu drepturi de root pe alte sisteme care sunt parte din <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/domain\/\"   title=\"domeniu\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4094\">domeniu<\/a>.\n<li class=\"l\"> CVE-2021-3738 \u2014 accesarea unei zone de memorie deja eliberate (Use after free) \u00een implementarea serverului RPC Samba AD DC (dsdb), care poate duce poten\u021bial la cre\u0219terea privilegiilor prin manipularea instal\u0103rii conexiunilor.\n<li class=\"l\"> CVE-2016-2124 \u2014 conexiunile clientului stabilite folosind protocolul SMB1 ar fi putut fi transmise cu parametrii de autentificare \u00een text clar sau prin NTLM (de exemplu, pentru a determina acreditivele \u00een timpul atacurilor MITM), chiar \u0219i \u00een cazul \u00een care pentru utilizator sau aplica\u021bie \u00een set\u0103ri este definit\u0103 obligativitatea autentific\u0103rii prin Kerberos.\n<li class=\"l\"> CVE-2020-25722 \u2014 \u00een controlerul de domeniu Active Directory bazat pe Samba, nu au fost efectuate verific\u0103ri adecvate de acces la datele stocate, ceea ce permitea oric\u0103rui utilizator s\u0103 ocoleasc\u0103 verific\u0103rile de autoritate \u0219i s\u0103 compromit\u0103 complet domeniul.\n<li class=\"l\"> CVE-2020-25718 \u2014 \u00een controlerul de domeniu Active Directory bazat pe Samba, ticket-urile Kerberos emise de RODC (Read-only domain controller) nu erau corect izolate, ceea ce putea fi utilizat pentru a ob\u021bine de la RODC ticket-uri de administrator, f\u0103r\u0103 a avea aceste autorit\u0103\u021bi.\n<li class=\"l\"> CVE-2020-25719 \u2014 controlerul de domeniu Active Directory bazat pe Samba nu verifica \u00eentotdeauna corect asocierea dintre c\u00e2mpurile SID \u0219i PAC \u00een biletele Kerberos (c\u00e2nd este configurat \u201egensec:require_pac = true\u201d, doar numele era verificat, iar PAC nu era luat \u00een considerare), ceea ce permitea unui utilizator cu drepturi de a crea conturi pe sistemul local s\u0103 se deghizeze ca alt utilizator din domeniu, inclusiv unul privilegiat.\n<li class=\"l\"> CVE-2020-25721 \u2014 pentru utilizatorii care s-au autentificat folosind Kerberos, identificatorii unici pentru Active Directory (objectSid) nu erau \u00eentotdeauna genera\u021bi \u00een mod unic, ceea ce putea duce la suprapuneri \u00eentre utilizatori.\n<li class=\"l\"> CVE-2021-23192 \u2014 \u00een timpul unui atac MITM, exista posibilitatea de a modifica fragmente \u00een cereri DCE\/RPC mari, care erau \u00eemp\u0103r\u021bite \u00een mai multe p\u0103r\u021bi.  <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56132\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043e\u0434\u043d\u0443 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0441 2016 \u0433\u043e\u0434\u0430, \u0430 \u043f\u044f\u0442\u044c &#8212; \u0441 2020 \u0433\u043e\u0434\u0430, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043e\u0434\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c winbindd \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &#171;allow trusted domains [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102262","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 Samba \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-11-10T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-11-10T19:36:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd478 vulnerabilit\u0103\u021bi critice au fost remediate \u00een Samba | ProHoster","description":"Au fost publicate versiuni corective pentru pachetul Samba 4.15.2, 4.14.10 \u0219i 4.13.14, remedieri pentru 8 vulnerabilit\u0103\u021bi, majoritatea dintre care pot conduce la compromiterea total\u0103 a domeniului Active Directory.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Samba \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.15.2, 4.14.10 \u0438 4.13.14 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 Active Directory.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-samba-ustraneno-8-opasnyh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-10T19:36:39+00:00","article:modified_time":"2021-11-10T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-10 19:37:53","updated":"2026-03-05 11:10:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102262"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102262\/revisions"}],"predecessor-version":[{"id":163197,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102262\/revisions\/163197"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}