CVE-2019-3880

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.

• CVE-2019-3880: Refuse winreg SaveKey/RestoreKey RPCs to prevent writing registry hive files outside intended share boundaries via symlink races
• CVE-2019-10218: Reject server-supplied filenames containing path separators in SMB1 directory listings to protect libsmbclient consumers from path traversal attacks

• CVE-2019-3880: Refuse winreg SaveKey/RestoreKey RPCs to prevent writing registry hive files outside intended share boundaries via symlink races
• CVE-2019-10218: Reject server-supplied filenames containing path separators in SMB1 directory listings to protect libsmbclient consumers from path traversal attacks
• CVE-2018-1050: Already fixed - upstream patch 0207 applied since the initial import
• CVE-2019-3824: Not affected - the vulnerable ldb_tdb / AD DC code lives in source4, which is not built by this spec (samba_source = source3)

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060).

ldb was updated to version 1.2.4 (bsc#1125410 bsc#1131686):

• Out of bound read in ldb_wildcard_compare
• Hold at most 10 outstanding paged result cookies
• Put 'results_store' into a doubly linked list
• Refuse to build Samba against a newer minor version of ldb

Non-security issues fixed:

• Fixed update-apparmor-samba-profile script after apparmor switched to using named profiles (bsc#1126377).
• Abide to the load_printers parameter in smb.conf (bsc#1124223).

This update was imported from SUSE:SLE-15:Update project.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060).

Non-security issues fixed:

• Fix vfs_ceph ftruncate and fallocate handling (bsc#1127153).
• Abide by load_printers smb.conf parameter (bsc#1124223).
• s3:winbindd: let normalize_name_map() call find_domain_from_name_noinit() (bsc#1123755).
• s3:passdb: Do not return OK if we don't have pinfo set up (bsc#1099590).
• s3:winbind: Fix regression (bsc#1123755).

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060).

ldb was updated to version 1.2.4 (bsc#1125410 bsc#1131686):

• Out of bound read in ldb_wildcard_compare
• Hold at most 10 outstanding paged result cookies
• Put 'results_store' into a doubly linked list
• Refuse to build Samba against a newer minor version of ldb

Non-security issues fixed:

• Fixed update-apparmor-samba-profile script after apparmor switched to using named profiles (bsc#1126377).
• Abide to the load_printers parameter in smb.conf (bsc#1124223).
• Provide the 32bit samba winbind PAM module and its dependend 32bit libraries.

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2019-3880: Save registry file outside share as unprivileged user (bsc#1131060).

Non-security issue fixed:

• Backport changes to support quotas with SMB2 (bsc#1106119).

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2019-3880: Save registry file outside share as unprivileged user (bsc#1131060).

Non-security issue fixed:

• Backport changes to support quotas with SMB2 (bsc#1106119).

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060).

Non-security issues fixed:

• Fixed an issue where the first login failed and subsequent ones work (bsc#1126463).
• Fixed winbind running out of memory with high number of domain groups (bsc#1114459).
• Backport changes to support quotas with SMB2 (bsc#1106119).

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060).

Non-security issue fixed:

• Make init scripts create log directories before running daemons (bsc#1101499)

Michael Hanselmann discovered that Samba incorrectly handled registry files. A remote attacker could possibly use this issue to create new registry files outside of the share, contrary to expectations.