A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:4325 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:4328 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2023-3347 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2222792 | Issue Tracking Third Party Advisory |
| https://www.samba.org/samba/security/CVE-2023-3347.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
16 Sep 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Jul 2024, 01:41
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-924 |
15 Aug 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Aug 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Jul 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat
Fedoraproject Fedoraproject fedora Redhat enterprise Linux Samba Redhat storage Samba samba |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.9 |
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:storage:3.0:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
|
| References |
|
|
| References | (MISC) https://www.samba.org/samba/security/CVE-2023-3347.html - Vendor Advisory | |
| References | (MISC) https://access.redhat.com/security/cve/CVE-2023-3347 - Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2222792 - Issue Tracking, Third Party Advisory | |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:4325 - Third Party Advisory | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/ - Mailing List | |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:4328 - Third Party Advisory |
31 Jul 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Jul 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jul 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-20 15:15
Updated : 2024-09-16 13:15
NVD link : CVE-2023-3347
Mitre link : CVE-2023-3347
CVE.ORG link : CVE-2023-3347
JSON object : View
Products Affected
samba
- samba
redhat
- enterprise_linux
- storage
fedoraproject
- fedora
CWE
NVD-CWE-noinfo
CWE-924
Improper Enforcement of Message Integrity During Transmission in a Communication Channel