{"id":17615,"date":"2020-11-02T14:18:26","date_gmt":"2020-11-02T14:18:26","guid":{"rendered":"http:\/\/dev.profelis.net\/?p=17615"},"modified":"2023-02-01T10:57:59","modified_gmt":"2023-02-01T07:57:59","slug":"sambabox-3-0-3-versiyonu-yayinda","status":"publish","type":"post","link":"https:\/\/profelis.com.tr\/en\/2020\/11\/02\/sambabox-3-0-3-versiyonu-yayinda\/","title":{"rendered":"SambaBox 3.0.3 Versiyonu Yay\u0131nda"},"content":{"rendered":"<p style=\"font-size: 19px;\"><span style=\"color: #000000;\">SambaBox&#8217;\u0131n\u00a0\u00f6nemli bir g\u00fcvenlik g\u00fcncelle\u015ftirmesini i\u00e7eren yeni s\u00fcr\u00fcm\u00fc yay\u0131nland\u0131. G\u00fcncellemelerinizi kendiniz uygulayabilece\u011finiz\u00a0gibi SambaBox\u00a0uzmanlar\u0131 taraf\u0131ndan yap\u0131lmas\u0131n\u0131 isterseniz\u00a0<span style=\"color: #3366ff;\"><a style=\"color: #3366ff;\" href=\"https:\/\/mantis.profelis.com.tr\/login_page.php\">https:\/\/mantis.profelis.com.tr<\/a><\/span>\u00a0\u00fczerinden talep olu\u015fturabilirsiniz.<\/span><\/p>\n<p style=\"font-size: 25px;\"><span style=\"color: #000000;\"><strong>Profelis Samba Paketi<\/strong><\/span><\/p>\n<p style=\"font-size: 25px;\"><span style=\"color: #000000;\">S\u00fcr\u00fcm: 4.12.9-15<\/span><\/p>\n<ul>\n<li><span style=\"color: #000000;\">CVE-2020-14318: SMB1\/2\/3 ChangeNotify&#8217;da eksik i\u015fleme izinleri kontrol\u00fc.<\/span><\/li>\n<li><span style=\"color: #000000;\">CVE-2020-14323: S\u0131radan kullan\u0131c\u0131 windbind \u00e7al\u0131\u015fmas\u0131n\u0131 bozabilir.<\/span><\/li>\n<li><span style=\"color: #000000;\">CVE-2020-14383: Kimli\u011fi do\u011frulanm\u0131\u015f bir kullan\u0131c\u0131, \u00f6zel haz\u0131rlanm\u0131\u015f kay\u0131tlarla DCE \/ RPC DNS&#8217;i bozabilir.<\/span><\/li>\n<\/ul>\n<p style=\"font-size: 25px;\"><span style=\"color: #000000;\"><strong>SambaBoxGUI<\/strong><\/span><\/p>\n<p style=\"font-size: 25px;\"><span style=\"color: #000000;\">S\u00fcr\u00fcm: 3.0.3<\/span><\/p>\n<ul>\n<li><span style=\"color: #000000;\">TLS i\u00e7in web servisi d\u00fczeltildi.<\/span><\/li>\n<li><span style=\"color: #000000;\">K\u00fc\u00e7\u00fck hatalar d\u00fczeltildi.\u00a0\u00a0<\/span><\/li>\n<\/ul>\n<p style=\"font-size: 25px;\"><span style=\"color: #000000;\"><strong>Details<\/strong><\/span><\/p>\n<p style=\"font-size: 21px;\"><span style=\"color: #000000;\"><strong>CVE-2020-14318:\u00a0<\/strong><\/span><\/p>\n<p><span style=\"color: #000000;\">SMB1\/2\/3 protokolleri &#8220;ChangeNotify&#8221; konseptini bar\u0131nd\u0131r\u0131r. Bu yap\u0131 ile istemci bir dizin i\u00e7erisinde &#8220;yeni dosya yaratma&#8221; veya &#8220;dosya boyutu de\u011fi\u015fimi&#8221; ya da &#8220;dosya zamandamgas\u0131 g\u00fcncellemesi&#8221; durumlar\u0131nda dosya ad\u0131n\u0131n bildirilmesini ister.<br \/>\nChangeNotify iste\u011fi g\u00f6nderimi i\u00e7in, dizin y\u00f6netiminde eksik izinlerin kontrol\u00fc yap\u0131lmas\u0131 gerekir. Bu izinler ile istemci sadece FILE_READ_ATTRIBUTES (minimum erisim) yetkisi kullanarak sunucudan de\u011fi\u015fiklik bilgisi yan\u0131t\u0131n\u0131 almal\u0131d\u0131r. Bu yan\u0131tlar\u0131 i\u00e7eren bilgiler dizinlere eri\u015fim i\u00e7in sadece FILE_READ_ATTRIBUTE \u015feklinde olmamal\u0131d\u0131r.<\/span><\/p>\n<p style=\"font-size: 21px;\"><span style=\"color: #000000;\"><strong>CVE-2020-14323:<\/strong><\/span><\/p>\n<p><span style=\"color: #000000;\">Winbind 3.6 ve sonraki versiyonlar\u0131nda, RPC \u00e7a\u011fr\u0131lar\u0131nda birden fazla SID yi isme \u00e7evirebilme \u00f6zelli\u011fi bulunur. Bu \u00f6zellik performans\u0131 artt\u0131rmak i\u00e7in eklenmi\u015ftir.<br \/>\nGerek\u00e7eler: Aktive Directory dizin y\u00f6neticisi olarak birden fazla SID tek bir RPC \u00e7a\u011fr\u0131s\u0131 \u00fczerinden isme \u00e7evrilebilir. Do\u011fal olarak Samba bu otomatik i\u015flemleri winbind \u00fczerinde unix dizin soketi ile yapan eklentiler sunar. B\u00f6ylece dizin hizmetlerinde network paketlerini azaltarak dizin servisi hizmetini \u00e7ok daha h\u0131zl\u0131 sunar. D\u00fczg\u00fcn girdi kontrol\u00fc yap\u0131lmad\u0131\u011f\u0131ndan elle \u00f6zel olarak de\u011fi\u015ftirilmi\u015f paketler ile winbind opetasyonlar\u0131n\u0131n NULL pointer atamas\u0131 ile durdurulmas\u0131 ve m\u00fcmk\u00fcn olabilir.<\/span><\/p>\n<p style=\"font-size: 21px;\"><span style=\"color: #000000;\"><strong>CVE-2020-14383:<\/strong> <\/span><\/p>\n<p><span style=\"color: #000000;\">Baz\u0131 DNS kay\u0131tlar\u0131 (MX ve NS gibi) ek baz\u0131 bilgiler i\u00e7erebilir. Samba dnsserver RPC pipe&#8217;lar\u0131 (sadece y\u00f6netimseldir, DNS servisinin kendisi i\u00e7in de\u011fildir), eksik\/hatal\u0131 kay\u0131tlar, ayarlanmam\u0131\u015f bellekler gibi RPC sunucunun hata vermesine sebep olabilecek durumlara kar\u015f\u0131 kontroller i\u00e7erir. RPC sunucu dnsservis d\u0131\u015f\u0131ndaki protokollerde de hizmet sunar. Bu servis yeniden ba\u015flad\u0131\u011f\u0131nda k\u0131sa bir bekleme olur. RPC sunucu kimlik do\u011frulamas\u0131n\u0131 yapm\u0131\u015f ve y\u00f6netici haklar\u0131nda olmayan bir kullan\u0131c\u0131 taraf\u0131ndan bu esnada yap\u0131lan bir sald\u0131r\u0131 sonucu Samba servisi \u00e7al\u0131\u015fmaya devam etse de bir \u00e7ok RPC servisi \u00e7al\u0131\u015fmayacakt\u0131r.<\/span><\/p>","protected":false},"excerpt":{"rendered":"<p>SambaBox&#8217;\u0131n\u00a0\u00f6nemli bir g\u00fcvenlik g\u00fcncelle\u015ftirmesini i\u00e7eren yeni s\u00fcr\u00fcm\u00fc yay\u0131nland\u0131. G\u00fcncellemelerinizi kendiniz uygulayabilece\u011finiz\u00a0gibi SambaBox\u00a0uzmanlar\u0131 taraf\u0131ndan yap\u0131lmas\u0131n\u0131 isterseniz\u00a0https:\/\/mantis.profelis.com.tr\u00a0\u00fczerinden talep olu\u015fturabilirsiniz. Profelis Samba Paketi S\u00fcr\u00fcm: 4.12.9-15 CVE-2020-14318: SMB1\/2\/3 ChangeNotify&#8217;da eksik i\u015fleme izinleri kontrol\u00fc. CVE-2020-14323: S\u0131radan kullan\u0131c\u0131 windbind \u00e7al\u0131\u015fmas\u0131n\u0131 bozabilir. CVE-2020-14383: Kimli\u011fi do\u011frulanm\u0131\u015f bir kullan\u0131c\u0131,&#8230;<\/p>","protected":false},"author":5,"featured_media":22104,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[44,47],"tags":[67,62],"class_list":["post-17615","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-duyuru","category-guncelleme","tag-guncelleme","tag-sambabox"],"_links":{"self":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts\/17615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/comments?post=17615"}],"version-history":[{"count":0,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts\/17615\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/media\/22104"}],"wp:attachment":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/media?parent=17615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/categories?post=17615"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/tags?post=17615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}