Synology-SA-22:24 Samba AD DC

Abstract

Multiple vulnerabilities allow remote attackers or remote authenticated users to bypass security constraint via a susceptible version of Synology Directory Server.

Affected Products

Mitigation

None

Detail

• CVE-2022-37966

  • Severity: Important
  • CVSS3 Base Score: 8.1
  • CVSS3 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability

• CVE-2022-37967

  • Severity: Important
  • CVSS3 Base Score: 7.2
  • CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • Windows Kerberos Elevation of Privilege Vulnerability

• CVE-2022-38023

  • Severity: Important
  • CVSS3 Base Score: 8.1
  • CVSS3 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Netlogon RPC Elevation of Privilege Vulnerability

• CVE-2022-45141

  • Severity: Important
  • CVSS3 Base Score: 8.1
  • CVSS3 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

Reference

• Samba Releases Security Updates
• CVE-2022-37966
• CVE-2022-37967
• CVE-2022-38023
• CVE-2022-45141

Revision