CVE-2019-14870

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

Updated samba packages fix security vulnerabilities:

Malicious servers can cause Samba client code to return filenames containing path separators to calling code (CVE-2019-10218).

When the password contains multi-byte (non-ASCII) characters, the check password script does not receive the full password string (CVE-2019-14833).

Users with the "get changes" extended access right can crash the AD DC LDAP server by requesting an attribute using the range= syntax (CVE-2019-14847).

An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name (CVE-2019-14861).

The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC (CVE-2019-14870).

Isaac Boukris reported that the Heimdal KDC before 7.7.1 does not apply delegation_not_allowed (aka not-delegated) user attributes for S4U2Self. Instead the forwardable flag is set even if the impersonated client has the not-delegated flag set. (CVE-2019-14870)

Joseph Sutton discovered that the Heimdal KDC before 7.7.1 does not check for missing sname in TGS-REQ (Ticket Granting Server Request) before dereferencing. An authenticated user could use this flaw to crash the KDC. (CVE-2021-3671)

It was discovered that Heimdal is prone to a NULL dereference in acceptors when the initial SPNEGO token has no acceptable mechanisms, which may result in denial of service for a server application that uses the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). (CVE-2021-44758)

Evgeny Legerov reported that the DES and Triple-DES decryption routines in the Heimdal GSSAPI library before 7.7.1 were prone to buffer overflow on malloc() allocated memory when presented with a maliciously small packet. In addition, the Triple-DES and RC4 (arcfour) decryption routine were prone to non-constant time leaks, which could potentially yield to a leak of secret key material when using these ciphers. (CVE-2022-3437)

It was discovered that Heimdal's PKI certificate validation library before 7.7.1 can under some circumstances perform an out-of-bounds memory access when normalizing Unicode, which may result in denial of service. (CVE-2022-41916)

Greg Hudson discovered an integer multiplication overflow in the Privilege Attribute Certificate (PAC) parsing routine, which may result in denial of service for Heimdal KDCs and possibly Heimdal servers (e.g., via GSS-API) on 32-bit systems. (CVE-2022-42898)

Douglas Bagnall and the Heimdal maintainers independently discovered that Heimdal's ASN.1 compiler before 7.7.1 generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free() function on the decoded structure upon decode error, which may result in remote code execution in the Heimdal KDC and possibly the Kerberos client, the X.509 library, and other components as well. (CVE-2022-44640)

This update for samba fixes the following issues:

• CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name (bsc#1158108).
• CVE-2019-14870: Fixed a DelegationNotAllowed not being enforced (bsc#1158109).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for libheimdal fixes the following issues:

Update to version 7.8.0

• CVE-2022-42898 PAC parse integer overflows
• CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour
• CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array
• CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors
• CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ
• CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec
• CVE-2019-14870: Validate client attributes in protocol-transition

This update for libheimdal fixes the following issues:

Update to version 7.8.0

• CVE-2022-42898 PAC parse integer overflows
• CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour
• CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array
• CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors
• CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ
• CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec
• CVE-2019-14870: Validate client attributes in protocol-transition

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libasn1-8-7.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name (bsc#1158108).
• CVE-2019-14870: Fixed a DelegationNotAllowed not being enforced (bsc#1158109).

This update for samba fixes the following issues:

• CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name (bsc#1158108).
• CVE-2019-14870: Fixed a DelegationNotAllowed not being enforced (bsc#1158109).

This update for samba to version 4.10.17 fixes the following issues:

• Fixed net command unable to negotiate SMB2; (bsc#1174120);

• Update to 4.10.17

  • CVE-2020-10745: Invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159).
  • CVE-2020-10760: Fix use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (1173161).
  • CVE-2020-14303: Fix endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined, ldb: Bump version to 1.5.8; (bso#14364); (bsc#1173159).

• Update to 4.10.16 s3: lib: Paranoia around use of snprintf copying into a fixed-size buffer from a getenv() pointer. lib:util: Fix smbclient -l basename dir; (bso#14345). Malicous SMB1 server can crash libsmbclient; (bso#14366). s3:libads: Fix ads_get_upn(); (bso#14336). docs-xml: Fix usernames in pam_winbind manpages; (bso#14358). Client tools are not able to read gencache anymore since 4.10; (bso#14370).

• Update to 4.10.15

  • CVE-2020-10700: Fix use-after-free in AD DC LDAP server when ASQ and paged_results combined; (bso#14331); (bsc#1169850).
  • CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#20454); (bsc#1169851).

• Update to 4.10.14 s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283). nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#20193). dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). auth: Fix CID 1458418 Null pointer dereferences (REVERSE_INULL), auth: Fix CID 1458420 Null pointer dereferences (REVERSE_INULL); (bso#14247). winbind member (source3) fails local SAM auth with empty domain name; (bso#14247). winbindd: Handling missing idmap in getgrgid(); (bso#14265). lib:util: Log mkdir error on correct debug levels; (bso#14253). wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295).

• Update to 4.10.13 s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). s3: libsmb: Ensure return from net_share_enum_rpc() sets cli->raw_status on error; (bso#14176). s3: smbd: SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). s3: smbd: Only set xconn->smb1.negprot.done = true after supported_protocols[protocol].proto_reply_fn() succeeds; (bso#14205). pygpo: Use correct method flags; (bso#14209). s3: Remove now unneeded call to cmdline_messaging_context(); (bso#13925). Incomplete conversion of former parametric options; (bso#14069). Fix sync dosmode fallback in async dosmode codepath; (bso#14070). vfs_fruit returns capped resource fork length; (bso#14171). s3:printing: Fix %J substition; (bso#13745). libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). ctdb-tcp: Close inflight connecting TCP sockets after fork; (bso#14175). s4:dirsync: Fix interaction of dirsync and extended_dn controls; (bso#14153). upgradedns: Ensure lmdb lock files linked; (bso#14199). s3: VFS: glusterfs: Reset nlinks for symlink entries during …

Andreas Oster discovered that the Samba DNS management server incorrectly handled certain records. An authenticated attacker could possibly use this issue to crash Samba, resulting in a denial of service. (CVE-2019-14861)

Isaac Boukris discovered that Samba did not enforce the Kerberos DelegationNotAllowed feature restriction, contrary to expectations. (CVE-2019-14870)

USN-4217-1 fixed several vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Andreas Oster discovered that the Samba DNS management server incorrectly handled certain records. An authenticated attacker could possibly use this issue to crash Samba, resulting in a denial of service. (CVE-2019-14861)

Isaac Boukris discovered that Samba did not enforce the Kerberos DelegationNotAllowed feature restriction, contrary to expectations. (CVE-2019-14870)