CVE-2020-10730

A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.

A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Updated samba packages fix security vulnerabilities:

Andrew Bartlett discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2020-10730).

Douglas Bagnall discovered that Samba incorrectly handled certain queries. A remote attacker could possibly use this issue to cause a denial of service (CVE-2020-10745).

Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2020-10760).

The AD DC NBT server in Samba 4.0 will enter a CPU spin and not process further requests once it receives a empty (zero-length) UDP packet to port 137 (CVE-2020-14303).

This update for samba fixes the following issues:

• CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).
• CVE-2020-14303: Fixed an endless loop when receiving at AD DC empty UDP packets (bsc#1173359).
• CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).
• CVE-2020-10760: Fixed a use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV (bsc#1173161).
• Added libnetapi-devel to baselibs conf, for wine usage (bsc#1172307).
• Fixed an installing issue where samba - samba-ad-dc.service did not exist and unit was not found (bsc#1171437).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for ldb, samba fixes the following issues:

Changes in samba:

• Update to samba 4.11.11
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159]
  • CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161)
  • CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
• Update to samba 4.11.10
  • Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374).
  • vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350)
  • ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413).
  • Malicous SMB1 server can crash libsmbclient; (bso#14366)
  • winbindd: Fix a use-after-free when winbind clients exit; (bso#14382)
  • ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330)
• Update to samba 4.11.9
  • nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242).
  • 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296).
  • smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237).
  • Missing check for DMAPI offline status in async DOS attributes; (bso#14293).
  • smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307).
  • vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316)
  • smbd mistakenly updates a file's write-time on close; (bso#14320).
  • RPC handles cannot be differentiated in source3 RPC server; (bso#14359).
  • librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  • nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327).
  • Fix fruit:time machine max size on arm; (bso#13622)
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294).
  • ctdb: Fix a memleak; (bso#14348).
  • libsmb: Don't try to find posix stat info in SMBC_getatr().
  • ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680).
  • s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095)
  • s3:libads: Fix ads_get_upn(); (bso#14336).
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294)
  • Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).
  • ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324)
• Update to samba 4.11.8
  • CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);
  • CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851);
• Update to samba 4.11.7
  • s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239).
  • s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283)
  • dsdb: Correctly handle memory in objectclass_attrs; (bso#14258).
  • ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270)
  • auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247).
  • smbd: Handle EINTR from open(2) properly; (bso#14285)
  • winbind member (source3) fails local SAM auth with empty domain name; (bso#14247)
  • winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  • lib:util: Log mkdir error on correct debug levels; (bso#14253).
  • wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266).
  • ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274).
• Update to samba…

This update for ldb fixes the following issues:

• CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for ldb, samba fixes the following issues:

Changes in samba:

• Update to samba 4.11.11
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159]
  • CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161)
  • CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
• Update to samba 4.11.10
  • Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374).
  • vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350)
  • ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413).
  • Malicous SMB1 server can crash libsmbclient; (bso#14366)
  • winbindd: Fix a use-after-free when winbind clients exit; (bso#14382)
  • ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330)
• Update to samba 4.11.9
  • nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242).
  • 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296).
  • smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237).
  • Missing check for DMAPI offline status in async DOS attributes; (bso#14293).
  • smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307).
  • vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316)
  • smbd mistakenly updates a file's write-time on close; (bso#14320).
  • RPC handles cannot be differentiated in source3 RPC server; (bso#14359).
  • librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  • nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327).
  • Fix fruit:time machine max size on arm; (bso#13622)
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294).
  • ctdb: Fix a memleak; (bso#14348).
  • libsmb: Don't try to find posix stat info in SMBC_getatr().
  • ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680).
  • s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095)
  • s3:libads: Fix ads_get_upn(); (bso#14336).
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294)
  • Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).
  • ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324)
• Update to samba 4.11.8
  • CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);
  • CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851);
• Update to samba 4.11.7
  • s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239).
  • s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283)
  • dsdb: Correctly handle memory in objectclass_attrs; (bso#14258).
  • ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270)
  • auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247).
  • smbd: Handle EINTR from open(2) properly; (bso#14285)
  • winbind member (source3) fails local SAM auth with empty domain name; (bso#14247)
  • winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  • lib:util: Log mkdir error on correct debug levels; (bso#14253).
  • wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266).
  • ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274).
• Update to samba…

These are all security issues fixed in the ldb-tools-2.3.0-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).
• CVE-2020-14303: Fixed an endless loop when receiving at AD DC empty UDP packets (bsc#1173359).
• CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).
• CVE-2020-10760: Fixed a use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV (bsc#1173161).
• Added libnetapi-devel to baselibs conf, for wine usage (bsc#1172307).
• Fixed an installing issue where samba - samba-ad-dc.service did not exist and unit was not found (bsc#1171437).

This update for ldb, samba fixes the following issues:

Changes in samba:

• Update to samba 4.11.11
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159]
  • CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161)
  • CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
• Update to samba 4.11.10
  • Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374).
  • vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350)
  • ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413).
  • Malicous SMB1 server can crash libsmbclient; (bso#14366)
  • winbindd: Fix a use-after-free when winbind clients exit; (bso#14382)
  • ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330)
• Update to samba 4.11.9
  • nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242).
  • 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296).
  • smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237).
  • Missing check for DMAPI offline status in async DOS attributes; (bso#14293).
  • smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307).
  • vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316)
  • smbd mistakenly updates a file's write-time on close; (bso#14320).
  • RPC handles cannot be differentiated in source3 RPC server; (bso#14359).
  • librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  • nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327).
  • Fix fruit:time machine max size on arm; (bso#13622)
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294).
  • ctdb: Fix a memleak; (bso#14348).
  • libsmb: Don't try to find posix stat info in SMBC_getatr().
  • ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680).
  • s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095)
  • s3:libads: Fix ads_get_upn(); (bso#14336).
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294)
  • Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).
  • ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324)
• Update to samba 4.11.8
  • CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);
  • CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851);
• Update to samba 4.11.7
  • s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239).
  • s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283)
  • dsdb: Correctly handle memory in objectclass_attrs; (bso#14258).
  • ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270)
  • auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247).
  • smbd: Handle EINTR from open(2) properly; (bso#14285)
  • winbind member (source3) fails local SAM auth with empty domain name; (bso#14247)
  • winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  • lib:util: Log mkdir error on correct debug levels; (bso#14253).
  • wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266).
  • ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274).
• Update to samba…

This update for ldb fixes the following issues:

• CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).

This update for samba to version 4.10.17 fixes the following issues:

• Fixed net command unable to negotiate SMB2; (bsc#1174120);

• Update to 4.10.17

  • CVE-2020-10745: Invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159).
  • CVE-2020-10760: Fix use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (1173161).
  • CVE-2020-14303: Fix endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined, ldb: Bump version to 1.5.8; (bso#14364); (bsc#1173159).

• Update to 4.10.16 s3: lib: Paranoia around use of snprintf copying into a fixed-size buffer from a getenv() pointer. lib:util: Fix smbclient -l basename dir; (bso#14345). Malicous SMB1 server can crash libsmbclient; (bso#14366). s3:libads: Fix ads_get_upn(); (bso#14336). docs-xml: Fix usernames in pam_winbind manpages; (bso#14358). Client tools are not able to read gencache anymore since 4.10; (bso#14370).

• Update to 4.10.15

  • CVE-2020-10700: Fix use-after-free in AD DC LDAP server when ASQ and paged_results combined; (bso#14331); (bsc#1169850).
  • CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#20454); (bsc#1169851).

• Update to 4.10.14 s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283). nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#20193). dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). auth: Fix CID 1458418 Null pointer dereferences (REVERSE_INULL), auth: Fix CID 1458420 Null pointer dereferences (REVERSE_INULL); (bso#14247). winbind member (source3) fails local SAM auth with empty domain name; (bso#14247). winbindd: Handling missing idmap in getgrgid(); (bso#14265). lib:util: Log mkdir error on correct debug levels; (bso#14253). wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295).

• Update to 4.10.13 s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). s3: libsmb: Ensure return from net_share_enum_rpc() sets cli->raw_status on error; (bso#14176). s3: smbd: SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). s3: smbd: Only set xconn->smb1.negprot.done = true after supported_protocols[protocol].proto_reply_fn() succeeds; (bso#14205). pygpo: Use correct method flags; (bso#14209). s3: Remove now unneeded call to cmdline_messaging_context(); (bso#13925). Incomplete conversion of former parametric options; (bso#14069). Fix sync dosmode fallback in async dosmode codepath; (bso#14070). vfs_fruit returns capped resource fork length; (bso#14171). s3:printing: Fix %J substition; (bso#13745). libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). ctdb-tcp: Close inflight connecting TCP sockets after fork; (bso#14175). s4:dirsync: Fix interaction of dirsync and extended_dn controls; (bso#14153). upgradedns: Ensure lmdb lock files linked; (bso#14199). s3: VFS: glusterfs: Reset nlinks for symlink entries during …

Andrew Bartlett discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10730)

Douglas Bagnall discovered that Samba incorrectly handled certain queries. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2020-10745)

Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10760)