Dhawaan cusbooneysiinta xirmada hagaajinta ayaa loo siidaayay noocyo kala duwan oo Samba ah, kuwaas oo ahaa noocyadii 4.15.2, 4.14.10 iyo 4.13.14, waxay hirgeliyeen isbeddelada ay ka mid yihiin ciribtirka 8 dayacanka, kuwaas oo intooda badan u horseedi kara tanaasul dhammaystiran ee domainka Active Directory.
Waa in la ogaadaa in mid ka mid ah arrimaha lagu go'aamiyay 2016, iyo shan, laga bilaabo 2020, in kasta oo hal hagaajin ay keentay awood la'aanta in lagu socodsiiyo winbindd goobaha joogitaanka "Ogow xayndaabka la aamini karo = maya»( Horumariyayaashu waxay ku talo jiraan inay isla markiiba sii daayaan cusboonaysiin kale oo dayactir ah).
Hawlahani waxay noqon karaan kuwo khatar ku ah gacmaha khaldan, sida isticmaaluhu qQof kasta oo abuura xisaabaadkan oo kale waxa uu leeyahay mudnaan ballaadhan oo aan ahayn abuurista oo keliya oo deji furayaasha sirta ah, laakiin si aad dib ugu magacawdo wakhti dambe xaddidaadda kaliya ayaa ah in aysan u dhigmin samAccountName jira.
Marka Samba uu u dhaqmo sidii xubin ka mid ah domainka AD oo uu aqbalo tigidhka Kerberos, waa inuu noqdaa khariidad xogta laga helay meesha UNIX ID isticmaale (uid). Tani Hadda waxa lagu sameeyaa iyada oo loo marayo magaca akoonka ee Hagaha Active Kerberos Shahaadada Sifada Gaarka ah ee Kerberos (PAC), ama Magaca akoontiga ee tigidhka (haddii aysan jirin PAC).
Tusaale ahaan, Samba wuxuu isku dayi doonaa inuu helo isticmaale "DOMAIN \ user" ka hor iyagoo isku dayaya inay helaan isticmaalaha "user". Haddii raadinta DOMAIN \ isticmaalaha uu ku guuldareysto, markaa mudnaanta fuulitaanka waa suurtagal.
Kuwa aan aqoon u lahayn Samba, waa inaad ogaataa in kani yahay mashruuc sii wadaya horumarinta laanta Samba 4.x oo leh fulin buuxda oo ah kontoroole domain iyo adeegga Tilmaamaha Firfircoon, oo la jaan qaadaya hirgelinta Windows 2000 isla markaana awood u leh inuu u adeego dhammaan noocyada macaamiisha Windows oo ay taageerayaan Microsoft, oo ay ku jiraan Windows 10.
Samba 4, waa - shey adeegsi badan, kaas oo sidoo kale bixiya hirgelinta server file, adeegga daabacaadda iyo server xaqiijinta (winbind).
Nuglaanta lagu baabi'iyay cusboonaysiinta la sii daayay, kuwan soo socda ayaa lagu sheegay:
- CVE-2020-25717- Sababo la xiriira cilad xagga caqligal ah ee isticmaaleyaasha khariidadeynta isticmaaleyaasha nidaamka maxalliga ah, isticmaaleha hagaha Active Directory kaas oo awood u leh inuu ku abuuro xisaabaad cusub nidaamkooda, oo lagu maareeyo ms-DS-MachineAccountQuota, wuxuu heli karaa xidid xididada nidaamyada kale ee ay ku jiraan. ee domainka.
- CVE-2021-3738- Gelitaanka aagga xusuusta ee horay loo sii daayay (Isticmaal bilaash ka dib) ee Samba AD DC RPC (dsdb) hirgelinta server, taas oo suurtogal ah u horseedi karta mudnaanta mudnaanta marka la maamulayo goobaha isku xirka.
CVE-2016-2124- Xidhiidhada macmiilka ee la sameeyay iyadoo la adeegsanayo hab-maamuuska SMB1 waxaa loo gudbin karaa gudbinta cabbirada xaqiijinta qoraal cad ama iyadoo la adeegsanayo NTLM (tusaale ahaan, si loo go'aamiyo aqoonsiga weerarrada MITM), xitaa haddii adeegsadaha ama codsiga loo habeeyey inuu yahay xaqiijinta qasabka ah ee Kerberos. - CVE-2020-25722- Jeegaga gelitaanka kaydinta ku filan laguma samaynin Samba-ku-salaysan maamulaha Hagaha Active Directory, taasoo u oggolaanaysa isticmaale kasta inuu dhaafo aqoonsiga oo uu gabi ahaanba wax u dhimo bogga.
- CVE-2020-25718- Tigidhada Kerberos ee ay soo saartay RODC (koontaroolaha domain-ka-akhri-kaliya) ayaan si sax ah u go'doomin maamulaha guud ee Hagaha Active Directory ee Samba, kaas oo loo isticmaali karo in laga helo tigidhada maamulka RODC iyada oo aan lahayn awood ay sidaas ku samayso.
- CVE-2020-25719- Samba ku salaysan Active Directory kontorooluhu had iyo jeer ma tixgelin SID iyo PAC beeraha tigidhada Kerberos ee xirmada (marka la dejiyo "gensec: need_pac = run", magaca kaliya iyo PAC aan xisaabta lagu darin), taas oo u oggolaatay isticmaalaha, kaas oo haysta Xaqa loo leeyahay in lagu sameeyo xisaabaadka nidaamka deegaanka, si aad isaga dhigto isticmaale domain kale, oo uu ku jiro mid mudnaan leh.
- XAFLAD-2020-25721: Isticmaalayaasha la xaqiijiyay iyadoo la isticmaalayo Kerberos, aqoonsiyada gaarka ah ee Hagaha Active (objectSid) had iyo jeer lama soo saarin, taasoo u horseedi karta isgoysyada isticmaalaha.
- CVE-2021-23192- Intii lagu guda jiray weerarkii MITM, waxaa suurtagal ah in lagu miro jajabyo codsiyo waaweyn oo DCE / RPC ah kuwaas oo loo kala qaybiyay qaybo badan.
Ugu dambeyntii, haddii aad xiisaynayso inaad wax badan ka ogaato, waxaad kala tashan kartaa faahfaahinta gudaha xiriirka soo socda.