VulnerableCode Package Details - pkg:alpm/archlinux/samba@4.16.3-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-7vgs-22mz-aaas Aliases: CVE-2022-32744	A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.	4.16.4-1 Affected by 0 other vulnerabilities.
VCID-juxe-59cy-aaaj Aliases: CVE-2022-2031	A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.	4.16.4-1 Affected by 0 other vulnerabilities.
VCID-raxb-8b7v-aaaq Aliases: CVE-2022-32745	A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.	4.16.4-1 Affected by 0 other vulnerabilities.
VCID-us5m-s1rt-aaad Aliases: CVE-2022-32746	A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.	4.16.4-1 Affected by 0 other vulnerabilities.
VCID-vdnn-s8fy-aaag Aliases: CVE-2022-32742	A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).	4.16.4-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-7vgs-22mz-aaas
Aliases:
CVE-2022-32744

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.