samba - Dec 2022 - Does CVE-2022-32744 apply if your Samba server is not a KDC?

This is in reference to https://www.samba.org/samba/security/CVE-2022-32744.html

Our KDC's are on Windows, not Linux so I assume we are not vulnerable here. 
And we do not need this setting in smb.conf

kpasswd port = 0

Thanks,
Jim Brand



This email and any attachments may contain information that is confidential
and/or privileged for the sole use of the intended recipient. Any use, review,
disclosure, copying, distribution or reliance by others, and any forwarding of
this email or its contents, without the express permission of the sender is
strictly prohibited by law. If you are not the intended recipient, please
contact the sender immediately, delete the e-mail and destroy all copies.

On Sun, 2022-12-11 at 12:40 +0000, Jim Brand via samba
wrote:
> This is in reference to 
> https://www.samba.org/samba/security/CVE-2022-32744.html
> 
> Our KDC's are on Windows, not Linux so I assume we are not vulnerable
> here. 
Correct, this is just a KDC side issue.

Andrew Bartlett


-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/Samba Team Member
(since 2001) https://samba.orgSamba Team Lead, Catalyst IT  
https://catalyst.net.nz/services/samba
Samba Development and Support, Catalyst IT - Expert Open SourceSolutions