CVE-2022-3437
Summary
| CVE | CVE-2022-3437 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-01-12 15:15:00 UTC |
|---|
| Updated | 2023-11-07 03:51:00 UTC |
|---|
| Description | A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| oss-security - [vs] heimdal: CVE-2022-45142: signature validation failure |
MLIST |
www.openwall.com |
|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| 2137774 – (CVE-2022-3437) CVE-2022-3437 samba: heap buffer overflow in GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal |
MISC |
bugzilla.redhat.com |
|
| Samba - Security Announcement Archive |
MISC |
www.samba.org |
|
| Samba: Multiple Vulnerabilities (GLSA 202309-06) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| December 2022 Heimdal Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| Heimdal: Multiple Vulnerabilities (GLSA 202310-06) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181242 Debian Security Update for heimdal (DSA 5287-1)
- 181249 Debian Security Update for heimdal (DLA 3206-1)
- 181550 Debian Security Update for heimdal (DLA 3311-1)
- 181552 Debian Security Update for heimdal (DSA 5344-1)
- 183706 Debian Security Update for sambaheimdal (CVE-2022-3437)
- 199102 Ubuntu Security Notification for Heimdal Vulnerabilities (USN-5800-1)
- 199130 Ubuntu Security Notification for Samba Vulnerabilities (USN-5822-1)
- 199228 Ubuntu Security Notification for Samba Vulnerabilities (USN-5936-1)
- 283246 Fedora Security Update for samba (FEDORA-2022-3dcb5a3785)
- 283360 Fedora Security Update for heimdal (FEDORA-2022-dba9ba8e2b)
- 283361 Fedora Security Update for heimdal (FEDORA-2022-cbbd105d08)
- 283375 Fedora Security Update for samba (FEDORA-2022-003403ec6b)
- 283404 Fedora Security Update for heimdal (FEDORA-2022-2c77cee4b5)
- 283455 Fedora Security Update for samba (FEDORA-2022-8a9a568dbe)
- 355336 Amazon Linux Security Advisory for samba : ALAS2023-2023-032
- 502599 Alpine Linux Security Update for heimdal
- 502620 Alpine Linux Security Update for samba
- 502655 Alpine Linux Security Update for heimdal
- 502790 Alpine Linux Security Update for samba
- 503810 Alpine Linux Security Update for samba
- 503994 Alpine Linux Security Update for heimdal
- 6000543 Debian Security Update for samba (DSA 5647-1)
- 672496 EulerOS Security Update for samba (EulerOS-SA-2023-1021)
- 672515 EulerOS Security Update for samba (EulerOS-SA-2023-1046)
- 672630 EulerOS Security Update for samba (EulerOS-SA-2023-1371)
- 672635 EulerOS Security Update for samba (EulerOS-SA-2023-1399)
- 673107 EulerOS Security Update for samba (EulerOS-SA-2023-2168)
- 690965 Free Berkeley Software Distribution (FreeBSD) Security Update for samba (1c5f3fd7-54bf-11ed-8d1e-005056a311d1)
- 710751 Gentoo Linux Samba Multiple Vulnerabilities (GLSA 202309-06)
- 710767 Gentoo Linux Heimdal Multiple Vulnerabilities (GLSA 202310-06)
- 752999 SUSE Enterprise Linux Security Update for samba (SUSE-SU-2022:4395-1)
- 753517 SUSE Enterprise Linux Security Update for samba (SUSE-SU-2023:0081-1)
- 753587 SUSE Enterprise Linux Security Update for samba (SUSE-SU-2023:0160-1)
- 905264 Common Base Linux Mariner (CBL-Mariner) Security Update for samba (12995)
