CVE-2023-3347: Samba: smb2 packet signing is not enforced when "server signing = required" is set

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fedoraproject fedora38
• redhat enterprise linux8.0
• redhat enterprise linux9.0
• redhat storage3.0
• samba samba4.17.0 and later · before 4.17.10
• samba samba4.18.0 and later · before 4.18.5

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Enterprise Linux 6

  • all versionsunknown
  • all versionsunknown

• Red Hat Red Hat Enterprise Linux 7

  • all versionsunknown

• Red Hat Red Hat Enterprise Linux 8

  • 0:4.17.5-3.el8_8 and laternot affected · rpm
  • 0:4.17.5-3.el8_8 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 9

  • 0:4.17.5-103.el9_2 and laternot affected · rpm
  • 0:4.17.5-103.el9_2 and laternot affected · rpm

• Red Hat Red Hat Storage 3

  • all versionsunknown

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-7494Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cliKEV
  99Now
• CVE-2015-0240The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x befor
  66This week
• CVE-2003-0085Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, al
  66This week

Published before and after this one in the same product

• ← EarlierCVE-2023-34967Jul 20, 2023 · Samba: type confusion in mdssvc rpc service for spotlight
  39Monitor
• ← EarlierCVE-2023-34968Jul 20, 2023 · Samba: spotlight server-side share path disclosure
  21Monitor
• Later →CVE-2023-5568Oct 25, 2023 · Samba: heap buffer overflow with freshness tokens in the heimdal kdc
  27Monitor

Root cause

The verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const claims = jwt.verify(token, publicKey);

1const claims = jwt.verify(token, publicKey, {2  algorithms: ["RS256"],3  issuer: "https://id.example.com",4  audience: "portal",5});

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.