Huzaifa S. Sidhpurwala

The issue is related to the support of RODC (read-only domain controller) functionality in Samba when it acts as an Active Directory Domain Controller. This could allow a remote attacker to elevate their privileges, potentially enabling them to print administrator tickets.

The issue is related to the use of 'association groups' in DCE/RPC, which allows sharing handles between multiple connections. These handles can reference connections to the sam.ldb database. However, when one connection within the association group ends, the database is left pointing at an invalid 'struct session info', potentially leading to a crash. It is also possible that this use-after-free condition could allow different user state to be pointed at, potentially enabling more privileged access. The vulnerability is associated with a use-after-free condition in the Samba AD DC RPC server software, which could be exploited by a remote attacker to cause a denial of service or elevate privileges.

The issue is related to errors in synchronization when using a shared resource due to incorrect metadata handling. This allows an authenticated attacker with permissions to read or modify share metadata to perform operations outside of the share, potentially leading to unauthorized access to confidential data and disruption of data integrity.

The issue is related to an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

A flaw was found in the way Nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service. The vulnerability is related to insufficient input validation in the RSA decryption functions.

A use-after-free flaw was found in the way samba AD DC LDAP servers handled 'Paged Results' control combined with the 'ASQ' control. This issue can be exploited by a malicious user in a samba AD to cause denial of service.

A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability.

The issue allows for a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

A flaw in the Samba routine `ndr pull dnsp name` contains an integer wrap problem, leading to an attacker-controlled memory overwrite. This routine parses data from the Samba Active Directory ldb database. Any user who can write to the `dnsRecord` attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the `dnsRecord` attribute on new DNS objects, making this a remote privilege escalation issue.

The issue allows attackers to impersonate the authenticated user or service using a forwardable Kerberos "Ticket Granting Ticket" (TGT) when Samba uses Kerberos authentication. This occurs because Samba always requested forwardable tickets. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

A flaw was found in the way Samba implemented SMB1 authentication, allowing an attacker to retrieve the plaintext password sent over the wire, even if Kerberos authentication was required. This could enable a remote attacker to perform a man-in-the-middle attack.

A flaw was found in the Diffie Hellman Client key exchange handling, making it vulnerable to a small subgroup confinement attack. This allows an attacker to recover private keys by confining the client DH key to a small subgroup of the desired group.

The issue allows local users to bypass authentication and modify firewall configurations. This can be achieved via specific D-Bus API methods, including `addPassthrough`, `removePassthrough`, `addEntry`, `removeEntry`, or `setEntries`.

The issue is related to an integer overflow in the `pv import` function, located in `util/lpv import.c`, which occurs when converting a file. This allows remote attackers to execute arbitrary code through a crafted file, resulting in a heap-based buffer overflow.

The issue is related to an integer overflow in the main function of util/lpci main.c. This occurs when converting a file and allows user-assisted remote attackers to execute arbitrary code via a crafted file, triggering a heap-based buffer overflow.

The issue is related to a stack-based buffer overflow in the main function in util/lpci main.c. This occurs when converting a file and allows user-assisted remote attackers to execute arbitrary code via a crafted file.

The issue is related to the handling of external entities expansion in libxml2, which can be exploited by remote attackers to cause a denial of service, send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document. This is an XML External Entity (XXE) issue. The `xmlSAX2ResolveEntity` and `xmlSetExternalEntityLoader` functions are involved in this issue, and it is noted that the responsibility for resolving this issue may lie with application developers, as libxml2 already provides the ability to disable external entity expansion.

The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a setuid process or pkexec process. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be performed locally.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and crash, via a PROPFIND request for an activity URL.

The issue makes it easier for remote authenticated users to conduct brute force password guessing attacks because the salt is not modified during multiple executions of the change user command within the same connection.