Siideynta saxda ah ee xirmada Samba 4.15.2, 4.14.10 iyo 4.13.14 ayaa la daabacay iyadoo meesha laga saaray 8 dayacan, kuwaas oo intooda badan u horseedi kara in si buuxda loo tanaasulo domainka Active Directory. Waxaa xusid mudan in mid ka mid ah dhibaatooyinka la hagaajiyay tan iyo 2016, iyo shan tan iyo 2020, si kastaba ha ahaatee, hal hagaajin ayaa suurtogal ka dhigay in la bilaabo winbindd oo leh "ogolow domains la aamini karo = maya" (horumariyayaashu waxay ku tala jiraan inay si dhakhso ah u daabacaan cusbooneysiin kale oo leh a hagaajin). Siideynta xirmada cusbooneysiinta ee qeybinta waxaa lagala socon karaa bogagga: Debian, Ubuntu, RHEL, SUSE, Fedora, Arch, FreeBSD.
Nuglaanta go'an:
- CVE-2020-25717 - iyadoo ay ugu wacan tahay cilad xagga caqligal ah ee isticmaaleyaasha khariidadeynta isticmaaleyaasha nidaamka maxalliga ah, isticmaaleha domainka Active Directory kaas oo awood u leh inuu ku sameeyo xisaabaad cusub nidaamkiisa, oo lagu maareeyo ms-DS-MachineAccountQuota, wuxuu heli karaa xidid. helitaanka nidaamyada kale ee ku jira domainka.
- CVE-2021-3738 waa Isticmaal ka dib gelitaanka bilaashka ah ee Samba AD DC RPC hirgelinta server-ka (dsdb), taas oo keeni karta kor u kaca mudnaanta marka la maamulayo isku xirka.
- CVE-2016-2124 - Xidhiidhada macmiilka ee la aasaasay iyadoo la adeegsanayo hab-maamuuska SMB1 waxaa loo bedeli karaa gudbinta cabbirrada xaqiijinta qoraal cad ama NTLM (tusaale, si loo go'aamiyo aqoonsiga inta lagu jiro weerarrada MITM), xitaa haddii isticmaaluhu ama codsigu leeyahay jaangooyooyinka loo cayimay ee qasabka ah xaqiijinta via Kerberos.
- CVE-2020-25722 - Samba-ku-salaysan Hagaha Active Directory ma samayn hubin sax ah oo ku saabsan xogta la kaydiyay, taasoo u oggolaanaysa isticmaale kasta inuu dhaafo jeegaga maamulka oo uu gabi ahaanba wax u dhimo xayndaabka.
- CVE-2020-25718 - Samba-ku-salaysan Hagaha Active Directory si sax ah uma uusan go'doomin tigidhada Kerberos ee ay bixiso RODC (Kontoroolka domain-ka-kaliya), kaas oo loo isticmaali karo in laga helo tigidhada maamulka RODC iyada oo aan fasax loo haysan in sidaas la sameeyo.
- CVE-2020-25719 - Samba-ku-salaysan Hagaha Active Directory mar walba ma xisaabtamin SID iyo PAC ee tigidhada Kerberos (marka la dejiyo "gensec:require_pac = run", magaca kaliya ayaa la hubiyay, PAC lama qaadan. xisaabta), kaas oo u oggolaaday isticmaalaha , kaas oo xaq u leh inuu sameeyo xisaabaadka nidaamka maxalliga ah, inuu iska dhigo isticmaale kale oo ku jira domainka, oo uu ku jiro mid mudnaanta leh.
- CVE-2020-25721 - Isticmaalayaasha la xaqiijiyay iyadoo la adeegsanayo Kerberos, aqoonsiga Hagaha Firfircoon ee gaarka ah (objectSid) mar walba lama soo saarin, kaasoo u horseedi kara isgoysyada hal isticmaale iyo mid kale.
- CVE-2021-23192 - Intii lagu guda jiray weerarka MITM, waxaa suurtagal ah in la miisaamo jajabyada codsiyada DCE/RPC ee waaweyn oo u kala qaybsan qaybo badan.
Source: opennet.ru