CVE-2020-25717

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

A suite for Linux to interoperate with Windows.

Security Fix(es):

Samba may map domain users to local users in an undesired way..(CVE-2020-25717)

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Active Directory (AD) domain user could become root on domain members (CVE-2020-25717)

• samba: SMB1 client connections can be downgraded to plaintext authentication (CVE-2016-2124)

• samba: Subsequent DCE/RPC fragment injection vulnerability (CVE-2021-23192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Active Directory (AD) domain user could become root on domain members (CVE-2020-25717)

• samba: SMB1 client connections can be downgraded to plaintext authentication (CVE-2016-2124)

• samba: Subsequent DCE/RPC fragment injection vulnerability (CVE-2021-23192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution (CVE-2021-44142)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Fix username map script regression introduced with CVE-2020-25717 (BZ#2046174)

• Fix possible segfault when joining the domain (BZ#2046160)

• CVE-2020-25717: Fix username map script regression (rhbz#2046174)
• Fix possible segfault while joining a domain (rhbz#2046160)

• CVE-2016-2124: Fix privilege escalation in Samba SMB1 authentication (rhbz#2021163)
• CVE-2021-23192: Fix DCE/RPC fragment injection vulnerability (rhbz#2021167)
• CVE-2020-25717: Fix privilege escalation in the way Samba maps domain users to local users (rhbz#2021171)

• CVE-2020-25717: Adapt CVE's patch to Centos 6 based systems where regular user id starts from 500, so change the default value of the new config parameters added: "min domain uid" to 500

• CVE-2020-25717: Adapt CVE's patch to Centos 6 based systems where regular user id starts from 500, so change the default value of the new config parameters added: "min domain uid" to 500

• SECURITY UPDATE: domain user can become root on a domain member by renaming a machine account
  • debian/patches/CVE-2020-25717.patch: backport the el6/ol6 8-commit subset (samba 3.6.23 precedent); introduce the new "min domain uid" smb.conf parameter (default 1000) and enforce it in check_account() so a domain logon resolving to a uid below the threshold is rejected with NT_STATUS_INVALID_TOKEN, drop the DOMAIN\user to user prefix-stripping fallback in smb_getpwnam(), stop autocreating local users from check_account() and from the kerberos guest fallback by passing create=false, drop the !winbind_ping() branch in create_local_token() so a missing winbindd no longer silently switches the unix-token computation, and require a PAC in any domain mode (DC or member) inside gensec_generate_session_info_pac() returning NT_STATUS_NO_IMPERSONATION_TOKEN otherwise (the gensec hunk is the jointly tagged CVE-2020-25717+CVE-2020-25719 commit, so this update also delivers the member-server portion of CVE-2020-25719; the DC-side portion of CVE-2020-25719 is tracked separately under ELSCVE-104393)
  • CVE-2020-25717
• SECURITY UPDATE: privileged attribute escalation and structural objectclass change in active directory ldap server
  • debian/patches/CVE-2020-25722.patch: in source4/dsdb/samdb/ldb_modules/objectclass.c, capture the current structural objectclass at the start of objectclass_do_mod and reject any modify that would change it; in source4/dsdb/samdb/ldb_modules/samldb.c, factor the domain ntSecurityDescriptor lookup into samldb_get_domain_secdesc() and add samldb_check_sensitive_attributes() invoked from samldb_add() and samldb_modify() to refuse non-system writes to sidHistory, gate msDS-SecondaryKrbTgtNumber on the DS-Install-Replica extended right, and gate msDS-AllowedToDelegateTo on SePrivEnableDelegation
  • CVE-2020-25722

• Rebase onto RHEL samba-4.14.5-9.el8_5: CVE-2021-44142, the CVE-2020-25717 username map script regression, the domain-join segfault and the dangling symlink directory deletion fixes are now provided by the base.
• Re-apply TuxCare ELS security backports on the new base:
• CVE-2022-32742: fix server memory information leak via SMB1
• CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC
• CVE-2022-1615: util/genrand: don't ignore errors in random number generation
• CVE-2022-2127: fix out-of-bounds read triggered by a malicious request
• CVE-2023-34966: fix infinite loop vulnerability in mdssvc RPC service
• CVE-2023-3961: fix a path traversal out of the socket directory
• CVE-2023-4091: fix file truncation issue in acl_xattr module
• CVE-2023-34967: fix type confusion vulnerability in mdssvc RPC service
• CVE-2023-34968: fix path disclosure vulnerability in mdssvc
• CVE-2023-42669: disable the rpcecho server
• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J

Multiple security issues affecting ldb, samba and sssd. See references for details.

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for samba and ldb fixes the following issues:

• CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).
• CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
• CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).
• CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

• Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
• Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Address flapping samba_tool_drs_showrepl test;(bso#14818).
• Address flapping dsdb_schema_attributes test;(bso#14819).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

• smbd: panic on force-close share during offload write; (bso#14769).
• Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
• smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
• net conf list crashes when run as normal user;(bso#14787).
• Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
• Start the SMB encryption as soon as possible;(bso#14793).
• Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

• CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)
• CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
• Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).

This update for samba fixes the following issues:

• Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).

These are all security issues fixed in the ctdb-4.15.2+git.193.a4d6307f1fd-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails (bsc#1192849).

This update for samba fixes the following issues:

The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails (bsc#1192849).

This update for samba fixes the following issues:

The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails (bsc#1192849).

This update for samba fixes the following issues:

The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails (bsc#1192849).

This update for samba fixes the following issues:

The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails (bsc#1192849).

This update for samba fixes the following issues:

The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails (bsc#1192849).

This update for samba fixes the following issues:

The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails (bsc#1192849).

This update for samba and ldb fixes the following issues:

• CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).
• CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
• CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).
• CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

• Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
• Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Address flapping samba_tool_drs_showrepl test;(bso#14818).
• Address flapping dsdb_schema_attributes test;(bso#14819).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

• smbd: panic on force-close share during offload write; (bso#14769).
• Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
• smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
• net conf list crashes when run as normal user;(bso#14787).
• Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
• Start the SMB encryption as soon as possible;(bso#14793).
• Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

• CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)
• CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
• Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).

This update for samba fixes the following issues:

• Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).

This update for samba fixes the following issues:

• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).

This update for ldb, samba fixes the following issues:

Changes in ldb:

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246)
• CVE-2021-3738: Fixed a crash in dsdb stack (bsc#1192215)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message
• Fix memory handling in ldb.msg_diff
• Backport bronze bit fixes, tests, and selftest improvements.

Changes in samba:

• CVE-2021-44142: Fixed an Out-of-Bound Read/Write on Samba vfs_fruit module; (bsc#1194859)

• The username map [script] advice from CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails; (bsc#1192849); (bso#14901).

• Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);

• CVE-2020-25717: Fixed that a user on the domain can become root on domain members; (bsc#1192284); (bso#14556).

• CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID values; (bsc#1192505); (bso#14564).

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);(bso#14558).

• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given;(bsc#1192247);(bso#14561).

• CVE-2020-25722: Fixed that AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues);(bsc#1192283); (bso#14564).

• CVE-2021-3738: Fixed a crash in dsdb stack;(bsc#1192215); (bso#14468).

• CVE-2021-23192: Fixed that dcerpc requests don't check all fragments against the first auth_state;(bsc#1192214);(bso#14875).

• CVE-2016-2124: don't fallback to non spnego authentication if we require kerberos; (bsc#1014440); (bso#12444).

Update to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

• Update to 4.13.12

  • Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
  • Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Address flapping samba_tool_drs_showrepl test;(bso#14818).
  • Address flapping dsdb_schema_attributes test;(bso#14819).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Fix CTDB flag/status update race conditions(bso#14784).

• Update to 4.13.11

  • smbd: panic on force-close share during offload write; (bso#14769).
  • Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
  • smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
  • net conf list crashes when run as normal user;(bso#14787).
  • Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
  • Start the SMB encryption as soon as possible;(bso#14793).
  • Winbind should not start if the socket path for the…

Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote attacker could possibly use this issue to downgrade connections to plaintext authentication. (CVE-2016-2124)

Andrew Bartlett discovered that Samba incorrectly mapping domain users to local users. An authenticated attacker could possibly use this issue to become root on domain members. (CVE-2020-25717)

Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos tickets issues by an RODC. An RODC could print administrator tickets, contrary to expectations. (CVE-2020-25718)

Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets. Delegated administrators could possibly use this issue to impersonate accounts, leading to total domain compromise. (CVE-2020-25719)

Andrew Bartlett discovered that Samba did not provide stable AD identifiers to Kerberos acceptors. (CVE-2020-25721)

Andrew Bartlett discovered that Samba did not properly check sensitive attributes. An authenticated attacker could possibly use this issue to escalate privileges. (CVE-2020-25722)

Stefan Metzmacher discovered that Samba incorrectly handled certain large DCE/RPC requests. A remote attacker could possibly use this issue to bypass signature requirements. (CVE-2021-23192)

William Ross discovered that Samba incorrectly handled memory. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly escalate privileges. (CVE-2021-3738)

Joseph Sutton discovered that Samba incorrectly handled certain TGS requests. An authenticated attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2021-3671)

The fix for CVE-2020-25717 results in possible behaviour changes that could affect certain environments. Please see the upstream advisory for more information:

https://www.samba.org/samba/security/CVE-2020-25717.html