CVE-2016-2118

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

Updated samba packages fix security vulnerability:

Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial of service, downgrade secure connections by performing a man in the middle attack, or possibly execute arbitrary code (CVE-2015-5370).

Stefan Metzmacher discovered that Samba contained multiple flaws in the NTLMSSP authentication implementation. A remote attacker could use this issue to downgrade connections to plain text by performing a man in the middle attack (CVE-2016-2110).

Alberto Solino discovered that a Samba domain controller would establish a secure connection to a server with a spoofed computer name. A remote attacker could use this issue to obtain sensitive information (CVE-2016-2111).

Stefan Metzmacher discovered that the Samba LDAP implementation did not enforce integrity protection. A remote attacker could use this issue to hijack LDAP connections by performing a man in the middle attack (CVE-2016-2112).

Stefan Metzmacher discovered that Samba did not enable integrity protection for IPC traffic. A remote attacker could use this issue to perform a man in the middle attack (CVE-2016-2115).

Stefan Metzmacher discovered that Samba incorrectly handled the MS-SAMR and MS-LSAD protocols. A remote attacker could use this flaw with a man in the middle attack to impersonate users and obtain sensitive information from the Security Account Manager database. This flaw is known as Badlock (CVE-2016-2118).

These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Samba was updated to the 4.2.x codestream, bringing some new features and security fixes (bsc#973832, FATE#320709).

These security issues were fixed:

• CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks (bsc#936862).
• CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bsc#973031).
• CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bsc#973032).
• CVE-2016-2112: LDAP conenctions were vulnerable to downgrade and MITM attack (bsc#973033).
• CVE-2016-2113: TLS certificate validation were missing (bsc#973034).
• CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks (bsc#973036).
• CVE-2016-2118: 'Badlock' DCERPC impersonation of authenticated account were possible (bsc#971965).

Also the following fixes were done:

• Upgrade on-disk FSRVP server state to new version; (bsc#924519).
• Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).
• Align fsrvp feature sources with upstream version.
• Obsolete libsmbsharemodes0 from samba-libs and libsmbsharemodes-devel from samba-core-devel; (bsc#973832).
• s3:utils/smbget: Fix recursive download; (bso#6482).
• s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489).
• docs: Add example for domain logins to smbspool man page; (bso#11643).
• s3-client: Add a KRB5 wrapper for smbspool; (bso#11690).
• loadparm: Fix memory leak issue; (bso#11708).
• lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714).
• ctdb-scripts: Drop use of 'smbcontrol winbindd ip-dropped ...'; (bso#11719).
• s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727).
• param: Fix str_list_v3 to accept ';' again; (bso#11732).
• Real memeory leak(buildup) issue in loadparm; (bso#11740).
• Obsolete libsmbclient from libsmbclient0 and libpdb-devel from libsamba-passdb-devel while not providing it; (bsc#972197).
• Getting and setting Windows ACLs on symlinks can change permissions on link
• Only obsolete but do not provide gplv2/3 package names; (bsc#968973).
• Enable clustering (CTDB) support; (bsc#966271).
• s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).
• vfs_fruit: Fix renaming directories with open files; (bso#11065).
• Fix MacOS finder error 36 when copying folder to Samba; (bso#11347).
• s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400).
• Fix copying files with vfs_fruit when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466).
• s3:libsmb: Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624).
• Reduce the memory footprint of empty string options; (bso#11625).
• lib/async_req: Do not install async_connect_send_test; (bso#11639).
• docs: Fix typos in man vfs_gpfs; (bso#11641).
• smbd: make 'hide dot files' option work with 'store dos attributes = yes'; (bso#11645).
• smbcacls: Fix uninitialized variable; (bso#11682).
• s3:smbd: Ignore initial allocation size for directory creation; (bso#11684).
• Changing log level of two entries to from 1 to 3; (bso#9912).
• vfs_gpfs: Re-enable share modes; (bso#11243).
• wafsamba: Also build libraries with RELRO protection; (bso#11346).
• ctdb: Strip trailing spaces from nodes file; (bso#11365).
• s3-smbd: Fix old DOS client doing wildcard delete - gives a attribute type of zero; (bso#11452).
• nss_wins: Do not run into use after free issues when we access memory allocated on the globals and the global being reinitialized; (bso#11563).
• async_req: Fix non-blocking connect(); (bso#11564).
• auth: gensec: Fix a memory leak; (bso#11565).
• lib: util: Make non-critical message a warning; (bso#11566).
• Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bsc#949022).
• smbd: Send SMB2 oplock breaks unencrypted; (bso#11570).
• ctdb: Open the RO tracking db…

samba was updated to fix seven security issues.

These security issues were fixed:

• CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks (bsc#936862).
• CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bsc#973031).
• CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bsc#973032).
• CVE-2016-2112: LDAP conenctions were vulnerable to downgrade and MITM attack (bsc#973033).
• CVE-2016-2113: TLS certificate validation were missing (bsc#973034).
• CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks (bsc#973036).
• CVE-2016-2118: 'Badlock' DCERPC impersonation of authenticated account were possible (bsc#971965).

These non-security issues were fixed:

• bsc#967017: Fix leaking memory in libsmbclient in cli_set_mntpoint function
• Getting and setting Windows ACLs on symlinks can change permissions on link

samba was updated to fix seven security issues.

These security issues were fixed:

• CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks (bsc#936862).
• CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bsc#973031).
• CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bsc#973032).
• CVE-2016-2112: LDAP conenctions were vulnerable to downgrade and MITM attack (bsc#973033).
• CVE-2016-2113: TLS certificate validation were missing (bsc#973034).
• CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks (bsc#973036).
• CVE-2016-2118: 'Badlock' DCERPC impersonation of authenticated account were possible (bsc#971965).

These non-security issues were fixed:

• bsc#974629: Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call.
• bsc#973832: Obsolete libsmbsharemodes0 from samba-libs and libsmbsharemodes-devel from samba-core-devel.
• bsc#972197: Obsolete libsmbclient from libsmbclient0 and libpdb-devel from libsamba-passdb-devel while not providing it.
• Getting and setting Windows ACLs on symlinks can change permissions on link
• bsc#924519: Upgrade on-disk FSRVP server state to new version.
• bsc#968973: Only obsolete but do not provide gplv2/3 package names.
• bso#6482: s3:utils/smbget: Fix recursive download.
• bso#10489: s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support.
• bso#11643: docs: Add example for domain logins to smbspool man page.
• bso#11690: s3-client: Add a KRB5 wrapper for smbspool.
• bso#11708: loadparm: Fix memory leak issue.
• bso#11714: lib/tsocket: Work around sockets not supporting FIONREAD.
• bso#11719: ctdb-scripts: Drop use of 'smbcontrol winbindd ip-dropped ...'.
• bso#11727: s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file.
• bso#11732: param: Fix str_list_v3 to accept ';' again.
• bso#11740: Real memeory leak(buildup) issue in loadparm.

samba was updated to fix seven security issues.

These security issues were fixed:

• CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks (bsc#936862).
• CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bsc#973031).
• CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bsc#973032).
• CVE-2016-2112: LDAP conenctions were vulnerable to downgrade and MITM attack (bsc#973033).
• CVE-2016-2113: TLS certificate validation were missing (bsc#973034).
• CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks (bsc#973036).
• CVE-2016-2118: 'Badlock' DCERPC impersonation of authenticated account were possible (bsc#971965).

These non-security issues were fixed:

• bsc#967017: Fix leaking memory in libsmbclient in cli_set_mntpoint function
• Getting and setting Windows ACLs on symlinks can change permissions on link

Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial of service, downgrade secure connections by performing a machine-in-the-middle attack, or possibly execute arbitrary code. (CVE-2015-5370)

Stefan Metzmacher discovered that Samba contained multiple flaws in the NTLMSSP authentication implementation. A remote attacker could use this issue to downgrade connections to plain text by performing a machine-in-the-middle attack. (CVE-2016-2110)

Alberto Solino discovered that a Samba domain controller would establish a secure connection to a server with a spoofed computer name. A remote attacker could use this issue to obtain sensitive information. (CVE-2016-2111)

Stefan Metzmacher discovered that the Samba LDAP implementation did not enforce integrity protection. A remote attacker could use this issue to hijack LDAP connections by performing a machine-in-the-middle attack. (CVE-2016-2112)

Stefan Metzmacher discovered that Samba did not validate TLS certificates. A remote attacker could use this issue to spoof a Samba server. (CVE-2016-2113)

Stefan Metzmacher discovered that Samba did not enforce SMB signing even if configured to. A remote attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2016-2114)

Stefan Metzmacher discovered that Samba did not enable integrity protection for IPC traffic. A remote attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2016-2115)

Stefan Metzmacher discovered that Samba incorrectly handled the MS-SAMR and MS-LSAD protocols. A remote attacker could use this flaw with a machine-in-the-middle attack to impersonate users and obtain sensitive information from the Security Account Manager database. This flaw is known as Badlock. (CVE-2016-2118)

Samba has been updated to 4.3.8 in Ubuntu 14.04 LTS and Ubuntu 15.10. Ubuntu 12.04 LTS has been updated to 3.6.25 with backported security fixes.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Configuration changes may be required in certain environments.