CVE - CVE-2022-0336

CVE-ID
CVE-2022-0336	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
GENTOO:GLSA-202309-06 URL:https://security.gentoo.org/glsa/202309-06 MISC:https://access.redhat.com/security/cve/CVE-2022-0336 URL:https://access.redhat.com/security/cve/CVE-2022-0336 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=2046134 URL:https://bugzilla.redhat.com/show_bug.cgi?id=2046134 MISC:https://bugzilla.samba.org/show_bug.cgi?id=14950 URL:https://bugzilla.samba.org/show_bug.cgi?id=14950 MISC:https://github.com/samba-team/samba/commit/1a5dc817c0c9379bbaab14c676681b42b0039a3c URL:https://github.com/samba-team/samba/commit/1a5dc817c0c9379bbaab14c676681b42b0039a3c MISC:https://github.com/samba-team/samba/commit/c58ede44f382bd0125f761f0479c8d48156be400 URL:https://github.com/samba-team/samba/commit/c58ede44f382bd0125f761f0479c8d48156be400 MISC:https://www.samba.org/samba/security/CVE-2022-0336.html URL:https://www.samba.org/samba/security/CVE-2022-0336.html
Assigning CNA
Red Hat, Inc.
Date Record Created
20220121	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220121)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)