CVE-2016-2125

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to fully impersonate the authenticated user or service (CVE-2016-2125).

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441).
• CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442).
• CVE-2016-2123: Heap-based Buffer Overflow Remote Code Execution Vulnerability. (bsc#1014437). This component is not built into our packages, so we are not affected.

Non security issues fixed:

• s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085)

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441).
• CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442).
• CVE-2016-2123: Heap-based Buffer Overflow Remote Code Execution Vulnerability. (bsc#1014437). The component affected is not built in our packages.

Non security issues fixed:

• s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085)
• Add doc changes for net ads --no-dns-updates switch; (bsc#991564)
• Include vfstest in samba-test; (bsc#1001203).
• s3/winbindd: using default domain with [email protected] format fails (bsc#997833).
• Fix illegal memory access after memory has been deleted (bsc#975299).
• Fix bug in tevent poll backend causing winbind to loop tightly (bsc#994500).
• Various fixes for spnego/ntlm (bsc#986675).

This update for samba provides the following fixes:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441)
• CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442)

Non security issues fixed:

• Allow SESSION KEY setup without signing. (bsc#1009711)
• Fix crash bug in tevent_queue_immediate_trigger(). (bsc#1003731)
• Don't fail when using default domain with [email protected] format. (bsc#997833)
• Prevent core, make sure response->extra_data.data is always cleared out. (bsc#993692)

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441).
• CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442).
• CVE-2016-2123: Heap-based Buffer Overflow Remote Code Execution Vulnerability. (bsc#1014437). This issue does not affect our packages, as the component is not built.

Non security issues fixed:

• s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port (bsc#1009085)
• Add doc changes for net ads --no-dns-updates switch (bsc#991564)
• Include vfstest in samba-test (bsc#1001203).
• s3/winbindd: using default domain with [email protected] format fails (bsc#997833).
• Fix illegal memory access after memory has been deleted (bsc#975299).
• Fix bug in tevent poll backend causing winbind to loop tightly (bsc#994500).
• Various fixes for spnego/ntlm (bsc#986675).

This update for samba provides the following fixes:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441)
• CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442)

Non security issues fixed:

• Allow SESSION KEY setup without signing. (bsc#1009711)
• Fix crash bug in tevent_queue_immediate_trigger(). (bsc#1003731)
• Don't fail when using default domain with [email protected] format. (bsc#997833)
• Prevent core, make sure response->extra_data.data is always cleared out. (bsc#993692)
• Honor smb.conf socket options in winbind. (bsc#975131)
• Fix crash with net rpc join. (bsc#978898)
• Fix a regression verifying the security trailer. (bsc#978898)
• Fix updating netlogon credentials. (bsc#978898)

Frederic Besler and others discovered that the ndr_pull_dnsp_nam function in Samba contained an integer overflow. An authenticated attacker could use this to gain administrative privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-2123)

Simo Sorce discovered that that Samba clients always requested a forwardable ticket when using Kerberos authentication. An attacker could use this to impersonate an authenticated user or service. (CVE-2016-2125)

Volker Lendecke discovered that Kerberos PAC validation implementation in Samba contained multiple vulnerabilities. An authenticated attacker could use this to cause a denial of service or gain administrative privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-2126)