¡¾Â©¶´Í¨¸æ¡¿Samba»º³åÇøÒç³ö©¶´£¨CVE-2022-3437£©

Ðû²¼Ê±¼ä 2022-10-26

0x00 ©¶´¸ÅÊö

CVE   ID

CVE-2022-3437

·¢ÏÖʱ¼ä

2022-10-25

Àà    ÐÍ

»º³åÇøÒç³ö

µÈ    ¼¶

ÖÐΣ

Ô¶³ÌÀûÓÃ

ÊÇ

Ó°Ï췶Χ


¹¥»÷ÅÓ´ó¶È

¸ß

Óû§½»»¥

ÎÞ

PoC/EXP


ÔÚÒ°ÀûÓÃ


 

0x01 ©¶´ÏêÇé

SambaÊÇÓÃÓÚLinuxºÍUnixµÄ³ß¶ÈWindows»¥²Ù×÷ÐÔ·¨Ê½Ì×¼þ £¬Ö¼ÔÚÌṩÄþ¾²¡¢Îȶ¨ºÍ¿ìËÙµÄÎļþºÍ´òÓ¡·þÎñ¡£

10ÔÂ25ÈÕ £¬SambaÍŶÓÐû²¼Äþ¾²Í¨¸æ £¬ÐÞ¸´ÁËSambaÈí¼þÖеÄÒ»¸ö»º³åÇøÒç³ö©¶´£¨CVE-2022-3437£© £¬ÆäCVSSÆÀ·ÖΪ5.9¡£

¸Ã©¶´´æÔÚÓÚHeimdal£¨°üÂÞÔÚSambaÖУ©GSSAPI ¿âÖеÄunwrap_des£¨£©ºÍunwrap_des3£¨£©Àý³ÌÖÐ £¬Ó°ÏìÁË×ÔSamba 4.0±àÒëÒÔÀ´µÄËùÓÐSamba°æ±¾¡£ÔÚĬÈÏÇé¿öÏ £¬µ±Samba±»±àÒëΪʹÓÃÄÚ²¿Heimdal Kerberos¿âʱ £¬»áʹÓÃÒ×Êܹ¥»÷µÄunwrap_des3£¨£© £¬Òò´Ë¸Ã©¶´»áÓ°ÏìÒÔĬÈϹ¹½¨Ñ¡Ïî¹¹½¨µÄÎļþ·þÎñÆ÷²¿Êð¡£

´ËÍâ £¬SambaÍŶӻ¹ÐÞ¸´ÁËÒ»¸ö·ûºÅÁ´½Ó©¶´£¨CVE-2022-3592£© £¬¸Ã©¶´µÄCVSSÆÀ·ÖΪ5.4 £¬Ó°ÏìÁË×Ô 4.17.0 ÒÔÀ´µÄËùÓÐ Samba °æ±¾¡£ÓÉÓÚSamba 4.17ÒÔÀ´ÔÚÓû§¿Õ¼äÖÐÒýÈëµÄ·ûºÅÁ´½ÓûÓÐÕýÈ·ÁýÕÖ £¬µ¼Ö¶ñÒâÓû§¿ÉÒÔͨ¹ý´´½¨·ûºÅÁ´½Ó £¬Ê¹smbdÕõÍÑÅäÖõĹ²Ïí·¾¶ £¬²¢ÀûÓøÃ©¶´·ÃÎÊ·þÎñÆ÷µÄËùÓÐÎļþϵͳ¡£

 

Ó°Ï췶Χ

CVE-2022-3437£º4.0 <= Samba °æ±¾ < 4.15.11¡¢4.16.6 »ò 4.17.2

CVE-2022-3592£º4.17.0 <= Samba °æ±¾ < Samba 4.17.2

 

0x02 Äþ¾²½¨Òé

ĿǰÕâЩ©¶´ÒѾ­ÐÞ¸´ £¬ÊÜÓ°ÏìÓû§¿ÉÒÔÉý¼¶µ½ÒÔϰ汾£º

CVE-2022-3437£ºÉý¼¶µ½Samba 4.15.11¡¢4.16.6 »ò 4.17.2¡£

CVE-2022-3592£ºÉý¼¶µ½Samba 4.17.2¡£

ÏÂÔØÁ´½Ó£º

https://www.samba.org/samba/history/security.html

×¢£º¶ÔÓÚCVE-2022-3437 £¬²¢·ÇËùÓеÄSamba°²×°¶¼ÊÐÊܵ½Ó°Ïì £¬Sambaͨ³£Ê¹ÓÃ--with-system-mitkrb5 ²ÎÊý±àÒëΪʹÓÃϵͳ MIT Kerberos £¬ÕâЩ°²×°²»»áÊܵ½Ó°Ïì¡£¶ÔÓÚCVE-2022-3592 £¬»º½â´ëÊ©Ïê¼û²Î¿¼Á´½ÓÖеÄÄþ¾²Í¨¸æ¡£

 

0x03 ²Î¿¼Á´½Ó

https://www.samba.org/samba/security/CVE-2022-3437.html

https://www.samba.org/samba/security/CVE-2022-3592.html

 

0x04 °æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2022-10-26

Ê×´ÎÐû²¼

 

0x05 ¸½Â¼

¶¶È¦Îª¶Ä¶øÉú¼ò½é

¶¶È¦Îª¶Ä¶øÉú½¨Á¢ÓÚ1996Äê £¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Äþ¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Äþ¾²²úÎï¡¢Äþ¾²·þÎñ½â¾ö·½°¸µÄÁ캽ÆóÒµÖ®Ò»¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¶¶È¦Îª¶Ä¶øÉú´óÏà £¬¹«Ë¾Ô±¹¤6000ÓàÈË £¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö £¬ÓµÓÐÁýÕÖÈ«¹úµÄÏúÊÛÌåϵ¡¢ÇþµÀÌåϵºÍ¼¼ÊõÖ§³ÖÌåϵ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´ £¬¶¶È¦Îª¶Ä¶øÉúÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÄþ¾²²úÎïºÍ×î¼Ñʵ¼ù·þÎñ £¬×ÊÖú¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄÄþ¾²ÐÔºÍÉú²úЧÄÜ £¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Äþ¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Å¬Á¦¡£


¹ØÓÚ¶¶È¦Îª¶Ä¶øÉú

¶¶È¦Îª¶Ä¶øÉúÄþ¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖØÒªÄþ¾²Â©¶´µÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÄþ¾²³ÂËß¡£

¹Ø×¢ÒÔϹ«ÖںŠ£¬»ñȡȫÇò×îÐÂÄþ¾²×ÊѶ£º

image.png