CVE-2016-2126

Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process (CVE-2016-2126).

Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this issue to access files on the server outside of the exported directories (CVE-2017-2619).

A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root (CVE-2017-7494).

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441).
• CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442).
• CVE-2016-2123: Heap-based Buffer Overflow Remote Code Execution Vulnerability. (bsc#1014437). This component is not built into our packages, so we are not affected.

Non security issues fixed:

• s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085)

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441).
• CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442).
• CVE-2016-2123: Heap-based Buffer Overflow Remote Code Execution Vulnerability. (bsc#1014437). The component affected is not built in our packages.

Non security issues fixed:

• s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085)
• Add doc changes for net ads --no-dns-updates switch; (bsc#991564)
• Include vfstest in samba-test; (bsc#1001203).
• s3/winbindd: using default domain with [email protected] format fails (bsc#997833).
• Fix illegal memory access after memory has been deleted (bsc#975299).
• Fix bug in tevent poll backend causing winbind to loop tightly (bsc#994500).
• Various fixes for spnego/ntlm (bsc#986675).

This update for samba provides the following fixes:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441)
• CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442)

Non security issues fixed:

• Allow SESSION KEY setup without signing. (bsc#1009711)
• Fix crash bug in tevent_queue_immediate_trigger(). (bsc#1003731)
• Don't fail when using default domain with [email protected] format. (bsc#997833)
• Prevent core, make sure response->extra_data.data is always cleared out. (bsc#993692)

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441).
• CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442).
• CVE-2016-2123: Heap-based Buffer Overflow Remote Code Execution Vulnerability. (bsc#1014437). This issue does not affect our packages, as the component is not built.

Non security issues fixed:

• s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port (bsc#1009085)
• Add doc changes for net ads --no-dns-updates switch (bsc#991564)
• Include vfstest in samba-test (bsc#1001203).
• s3/winbindd: using default domain with [email protected] format fails (bsc#997833).
• Fix illegal memory access after memory has been deleted (bsc#975299).
• Fix bug in tevent poll backend causing winbind to loop tightly (bsc#994500).
• Various fixes for spnego/ntlm (bsc#986675).

This update for samba provides the following fixes:

Security issues fixed:

• CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441)
• CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442)

Non security issues fixed:

• Allow SESSION KEY setup without signing. (bsc#1009711)
• Fix crash bug in tevent_queue_immediate_trigger(). (bsc#1003731)
• Don't fail when using default domain with [email protected] format. (bsc#997833)
• Prevent core, make sure response->extra_data.data is always cleared out. (bsc#993692)
• Honor smb.conf socket options in winbind. (bsc#975131)
• Fix crash with net rpc join. (bsc#978898)
• Fix a regression verifying the security trailer. (bsc#978898)
• Fix updating netlogon credentials. (bsc#978898)

Frederic Besler and others discovered that the ndr_pull_dnsp_nam function in Samba contained an integer overflow. An authenticated attacker could use this to gain administrative privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-2123)

Simo Sorce discovered that that Samba clients always requested a forwardable ticket when using Kerberos authentication. An attacker could use this to impersonate an authenticated user or service. (CVE-2016-2125)

Volker Lendecke discovered that Kerberos PAC validation implementation in Samba contained multiple vulnerabilities. An authenticated attacker could use this to cause a denial of service or gain administrative privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-2126)