Huzaifa S. Sidhpurwala

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** The issue is related to the support of RODC (read-only domain controller) functionality in Samba when it acts as an Active Directory Domain Controller. This could allow a remote attacker to elevate their privileges, potentially enabling them to print administrator tickets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** The issue is related to the use of 'association groups' in DCE/RPC, which allows sharing handles between multiple connections. These handles can reference connections to the sam.ldb database. However, when one connection within the association group ends, the database is left pointing at an invalid 'struct session info', potentially leading to a crash. It is also possible that this use-after-free condition could allow different user state to be pointed at, potentially enabling more privileged access. The vulnerability is associated with a use-after-free condition in the Samba AD DC RPC server software, which could be exploited by a remote attacker to cause a denial of service or elevate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** The issue is related to errors in synchronization when using a shared resource due to incorrect metadata handling. This allows an authenticated attacker with permissions to read or modify share metadata to perform operations outside of the share, potentially leading to unauthorized access to confidential data and disruption of data integrity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vsftpd (affected versions not specified) Sendmail (affected versions not specified) Nginx (affected versions not specified) **Description** The issue is related to an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. **Recommendations** For vsftpd, consider implementing additional security measures to protect against MiTM attacks, such as encrypting data in transit. For Sendmail, as a temporary workaround, consider disabling the use of multi-domain or wildcard certificates until a patch is available. For Nginx, restrict access to sensitive areas of the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nettle (affected versions not specified) **Description** A flaw was found in the way Nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service. The vulnerability is related to insufficient input validation in the RSA decryption functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** samba versions prior to 4.10.15 samba versions prior to 4.11.8 samba versions prior to 4.12.2 **Description** A use-after-free flaw was found in the way samba AD DC LDAP servers handled 'Paged Results' control combined with the 'ASQ' control. This issue can be exploited by a malicious user in a samba AD to cause denial of service. **Recommendations** For versions prior to 4.10.15, update to version 4.10.15 or later. For versions prior to 4.11.8, update to version 4.11.8 or later. For versions prior to 4.12.2, update to version 4.12.2 or later. As a temporary workaround, consider restricting access to the `Paged Results` and `ASQ` controls in the LDAP server until a patch is available.

**Name of the Vulnerable Software and Affected Versions** samba versions prior to 4.10.15 samba versions prior to 4.11.8 samba versions prior to 4.12.2 **Description** A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. **Recommendations** For samba versions prior to 4.10.15, update to version 4.10.15 or later. For samba versions prior to 4.11.8, update to version 4.11.8 or later. For samba versions prior to 4.12.2, update to version 4.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** nss versions prior to 3.30 **Description** The issue allows for a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA. **Recommendations** For versions prior to 3.30, update to version 3.30 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samba versions 4.0.0 through 4.5.2 **Description** A flaw in the Samba routine `ndr pull dnsp name` contains an integer wrap problem, leading to an attacker-controlled memory overwrite. This routine parses data from the Samba Active Directory ldb database. Any user who can write to the `dnsRecord` attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the `dnsRecord` attribute on new DNS objects, making this a remote privilege escalation issue. **Recommendations** For Samba versions 4.0.0 through 4.5.2, consider restricting access to the `dnsRecord` attribute over LDAP to prevent exploitation until a patch is available. As a temporary workaround, limit the privileges of authenticated LDAP users to minimize the risk of remote privilege escalation.

**Name of the Vulnerable Software and Affected Versions** Samba versions prior to 4.5.3 Samba versions prior to 4.4.8 Samba versions prior to 4.3.13 **Description** The issue allows attackers to impersonate the authenticated user or service using a forwardable Kerberos "Ticket Granting Ticket" (TGT) when Samba uses Kerberos authentication. This occurs because Samba always requested forwardable tickets. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. **Recommendations** For versions prior to 4.5.3, update to version 4.5.3 or later. For versions prior to 4.4.8, update to version 4.4.8 or later. For versions prior to 4.3.13, update to version 4.3.13 or later.

**Name of the Vulnerable Software and Affected Versions** Samba versions prior to the fixed version **Description** A flaw was found in the way Samba implemented SMB1 authentication, allowing an attacker to retrieve the plaintext password sent over the wire, even if Kerberos authentication was required. This could enable a remote attacker to perform a man-in-the-middle attack. **Recommendations** For versions prior to the fixed version, consider disabling SMB1 authentication until a patch is available. As a temporary workaround, restrict the use of plaintext passwords in SMB1 connections to minimize the risk of exploitation. Avoid using SMB1 for authentication whenever possible, and opt for more secure authentication methods like Kerberos. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NSS versions 3.21.x **Description** A flaw was found in the Diffie Hellman Client key exchange handling, making it vulnerable to a small subgroup confinement attack. This allows an attacker to recover private keys by confining the client DH key to a small subgroup of the desired group. **Recommendations** For NSS versions 3.21.x, consider updating to a newer version that addresses this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** firewalld versions prior to 0.4.3.3 **Description** The issue allows local users to bypass authentication and modify firewall configurations. This can be achieved via specific D-Bus API methods, including `addPassthrough`, `removePassthrough`, `addEntry`, `removeEntry`, or `setEntries`. **Recommendations** For versions prior to 0.4.3.3, update to version 0.4.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the D-Bus API methods `addPassthrough`, `removePassthrough`, `addEntry`, `removeEntry`, and `setEntries` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Csound versions prior to 5.16.6 **Description** The issue is related to an integer overflow in the `pv import` function, located in `util/lpv import.c`, which occurs when converting a file. This allows remote attackers to execute arbitrary code through a crafted file, resulting in a heap-based buffer overflow. **Recommendations** For versions prior to 5.16.6, update to version 5.16.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the `pv import` function in `util/lpv import.c` to minimize the risk of exploitation. Avoid using the `pv import` function with untrusted input files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Csound versions prior to 5.17.2 **Description** The issue is related to an integer overflow in the main function of util/lpci main.c. This occurs when converting a file and allows user-assisted remote attackers to execute arbitrary code via a crafted file, triggering a heap-based buffer overflow. **Recommendations** For versions prior to 5.17.2, update to version 5.17.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Csound versions prior to 5.17.2 **Description** The issue is related to a stack-based buffer overflow in the main function in util/lpci main.c. This occurs when converting a file and allows user-assisted remote attackers to execute arbitrary code via a crafted file. **Recommendations** For versions prior to 5.17.2, update to version 5.17.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libxml2 versions prior to 2.9.2 **Description** The issue is related to the handling of external entities expansion in libxml2, which can be exploited by remote attackers to cause a denial of service, send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document. This is an XML External Entity (XXE) issue. The `xmlSAX2ResolveEntity` and `xmlSetExternalEntityLoader` functions are involved in this issue, and it is noted that the responsibility for resolving this issue may lie with application developers, as libxml2 already provides the ability to disable external entity expansion. **Recommendations** For libxml2 versions prior to 2.9.2, consider using the `xmlSAX2ResolveEntity` or `xmlSetExternalEntityLoader` function to properly handle external entities expansion, or disable external entity expansion to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of the `xmlSAX2ResolveEntity` and `xmlSetExternalEntityLoader` functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** RealtimeKit (aka rtkit) version 0.5 **Description** The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a setuid process or pkexec process. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be performed locally. **Recommendations** For RealtimeKit (aka rtkit) version 0.5, as a temporary workaround, consider restricting access to the D-Bus communication with a polkit authority until a patch is available. Additionally, restrict the use of setuid processes and pkexec processes to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Subversion versions 1.6.x through 1.6.20 Subversion versions 1.7.0 through 1.7.8 **Description** The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and crash, via a PROPFIND request for an activity URL. **Recommendations** For Subversion versions 1.6.x through 1.6.20, update to a version outside of this range to resolve the issue. For Subversion versions 1.7.0 through 1.7.8, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the `mod dav svn` module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle MySQL and MariaDB versions 5.2.x through 5.2.13 Oracle MySQL and MariaDB versions 5.3.x through 5.3.11 Oracle MySQL and MariaDB versions 5.5.x through 5.5.28 **Description** The issue makes it easier for remote authenticated users to conduct brute force password guessing attacks because the salt is not modified during multiple executions of the change user command within the same connection. **Recommendations** For Oracle MySQL and MariaDB versions 5.2.x through 5.2.13, update to version 5.2.14 or later. For Oracle MySQL and MariaDB versions 5.3.x through 5.3.11, update to version 5.3.12 or later. For Oracle MySQL and MariaDB versions 5.5.x through 5.5.28, update to version 5.5.29 or later.