VulnerableCode Package Details - pkg:alpm/archlinux/samba@4.17.4-4

Search for packages

Vulnerability	Summary	Fixed by
VCID-4y3f-523m-aaak Aliases: CVE-2022-45141	Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).	4.17.5-1 Affected by 0 other vulnerabilities.
VCID-djmc-t9ae-aaap Aliases: CVE-2022-38023	Netlogon RPC Elevation of Privilege Vulnerability.	4.17.5-1 Affected by 0 other vulnerabilities.
VCID-m9ne-ccbr-aaak Aliases: CVE-2022-3437	A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.	4.17.5-1 Affected by 0 other vulnerabilities.
VCID-qr91-uuuy-aaas Aliases: CVE-2022-42898	PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."	4.17.5-1 Affected by 0 other vulnerabilities.
VCID-vpyw-hewy-aaap Aliases: CVE-2022-37966	Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability.	4.17.5-1 Affected by 0 other vulnerabilities.
VCID-x7df-8cm1-aaaj Aliases: CVE-2022-37967	Windows Kerberos Elevation of Privilege Vulnerability.	4.17.5-1 Affected by 0 other vulnerabilities.
VCID-xkcz-7qfm-aaab Aliases: CVE-2022-3492	A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the component Profile Photo Handler. The manipulation of the argument parameter leads to os command injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-210772.	4.17.5-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-4y3f-523m-aaak
Aliases:
CVE-2022-45141

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).