CVE-2023-3347: Samba: smb2 packet signing is not enforced when "server signing = required" is set
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/sambato a version that resolves this vulnerability.Fixed in 2:4.17.7+dfsg-1ubuntu1.1 - Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.9.5+dfsg-5+deb10u3Fixed in 2:4.9.5+dfsg-5+deb10u4Fixed in 2:4.13.13+dfsg-1~deb11u5Fixed in 2:4.17.12+dfsg-0+deb12u1Fixed in 2:4.19.3+dfsg-2 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.17.10 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.18.5 - Configuration
Ensure SMB2 packet signing is enforced in Samba. The text states that SMB2 packet signing is not enforced when an admin configures "server signing = required" (including SMB2 connections to Domain Controllers where signing is mandatory), so review/change this setting/behavior so SMB2 signing is actually enforced.
Samba server signing = required - Compensating control
As a mitigation for man-in-the-middle risk, restrict/segment SMB traffic so attackers cannot intercept/modify SMB2 messages between clients and servers (e.g., limit network paths/ACLs to trusted hosts).
Event History
Frequently Asked Questions
What is CVE-2023-3347?
CVE-2023-3347 is a vulnerability found in Samba's SMB2 packet signing mechanism.
What is the severity of CVE-2023-3347?
The severity of CVE-2023-3347 is medium with a severity value of 5.9.
How does CVE-2023-3347 affect Samba?
CVE-2023-3347 affects Samba by bypassing the SMB2 packet signing mechanism if certain conditions are met.
How can I fix CVE-2023-3347?
To fix CVE-2023-3347, update Samba to version 2:4.17.7+dfsg-1ubuntu1.1 (for Ubuntu), 4.17.10 or 4.18.5 (for Redhat), or the corresponding patched version for your distribution.
Where can I find more information about CVE-2023-3347?
For more information about CVE-2023-3347, you can visit the official Samba website at https://www.samba.org/samba/security/CVE-2023-3347.html