CVE-2020-14303

A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.

A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.

Updated samba packages fix security vulnerabilities:

Andrew Bartlett discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2020-10730).

Douglas Bagnall discovered that Samba incorrectly handled certain queries. A remote attacker could possibly use this issue to cause a denial of service (CVE-2020-10745).

Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2020-10760).

The AD DC NBT server in Samba 4.0 will enter a CPU spin and not process further requests once it receives a empty (zero-length) UDP packet to port 137 (CVE-2020-14303).

This update for samba fixes the following issues:

• CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).
• CVE-2020-14303: Fixed an endless loop when receiving at AD DC empty UDP packets (bsc#1173359).
• CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).
• CVE-2020-10760: Fixed a use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV (bsc#1173161).
• Added libnetapi-devel to baselibs conf, for wine usage (bsc#1172307).
• Fixed an installing issue where samba - samba-ad-dc.service did not exist and unit was not found (bsc#1171437).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for ldb, samba fixes the following issues:

Changes in samba:

• Update to samba 4.11.11
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159]
  • CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161)
  • CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
• Update to samba 4.11.10
  • Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374).
  • vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350)
  • ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413).
  • Malicous SMB1 server can crash libsmbclient; (bso#14366)
  • winbindd: Fix a use-after-free when winbind clients exit; (bso#14382)
  • ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330)
• Update to samba 4.11.9
  • nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242).
  • 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296).
  • smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237).
  • Missing check for DMAPI offline status in async DOS attributes; (bso#14293).
  • smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307).
  • vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316)
  • smbd mistakenly updates a file's write-time on close; (bso#14320).
  • RPC handles cannot be differentiated in source3 RPC server; (bso#14359).
  • librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  • nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327).
  • Fix fruit:time machine max size on arm; (bso#13622)
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294).
  • ctdb: Fix a memleak; (bso#14348).
  • libsmb: Don't try to find posix stat info in SMBC_getatr().
  • ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680).
  • s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095)
  • s3:libads: Fix ads_get_upn(); (bso#14336).
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294)
  • Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).
  • ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324)
• Update to samba 4.11.8
  • CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);
  • CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851);
• Update to samba 4.11.7
  • s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239).
  • s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283)
  • dsdb: Correctly handle memory in objectclass_attrs; (bso#14258).
  • ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270)
  • auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247).
  • smbd: Handle EINTR from open(2) properly; (bso#14285)
  • winbind member (source3) fails local SAM auth with empty domain name; (bso#14247)
  • winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  • lib:util: Log mkdir error on correct debug levels; (bso#14253).
  • wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266).
  • ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274).
• Update to samba…

This update for ldb, samba fixes the following issues:

Changes in samba:

• Update to samba 4.11.11
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159]
  • CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161)
  • CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
• Update to samba 4.11.10
  • Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374).
  • vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350)
  • ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413).
  • Malicous SMB1 server can crash libsmbclient; (bso#14366)
  • winbindd: Fix a use-after-free when winbind clients exit; (bso#14382)
  • ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330)
• Update to samba 4.11.9
  • nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242).
  • 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296).
  • smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237).
  • Missing check for DMAPI offline status in async DOS attributes; (bso#14293).
  • smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307).
  • vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316)
  • smbd mistakenly updates a file's write-time on close; (bso#14320).
  • RPC handles cannot be differentiated in source3 RPC server; (bso#14359).
  • librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  • nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327).
  • Fix fruit:time machine max size on arm; (bso#13622)
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294).
  • ctdb: Fix a memleak; (bso#14348).
  • libsmb: Don't try to find posix stat info in SMBC_getatr().
  • ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680).
  • s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095)
  • s3:libads: Fix ads_get_upn(); (bso#14336).
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294)
  • Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).
  • ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324)
• Update to samba 4.11.8
  • CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);
  • CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851);
• Update to samba 4.11.7
  • s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239).
  • s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283)
  • dsdb: Correctly handle memory in objectclass_attrs; (bso#14258).
  • ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270)
  • auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247).
  • smbd: Handle EINTR from open(2) properly; (bso#14285)
  • winbind member (source3) fails local SAM auth with empty domain name; (bso#14247)
  • winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  • lib:util: Log mkdir error on correct debug levels; (bso#14253).
  • wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266).
  • ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274).
• Update to samba…

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).
• CVE-2020-14303: Fixed an endless loop when receiving at AD DC empty UDP packets (bsc#1173359).
• CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).
• CVE-2020-10760: Fixed a use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV (bsc#1173161).
• Added libnetapi-devel to baselibs conf, for wine usage (bsc#1172307).
• Fixed an installing issue where samba - samba-ad-dc.service did not exist and unit was not found (bsc#1171437).

This update for ldb, samba fixes the following issues:

Changes in samba:

• Update to samba 4.11.11
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159]
  • CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161)
  • CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
• Update to samba 4.11.10
  • Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374).
  • vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350)
  • ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413).
  • Malicous SMB1 server can crash libsmbclient; (bso#14366)
  • winbindd: Fix a use-after-free when winbind clients exit; (bso#14382)
  • ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330)
• Update to samba 4.11.9
  • nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242).
  • 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296).
  • smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237).
  • Missing check for DMAPI offline status in async DOS attributes; (bso#14293).
  • smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307).
  • vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316)
  • smbd mistakenly updates a file's write-time on close; (bso#14320).
  • RPC handles cannot be differentiated in source3 RPC server; (bso#14359).
  • librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  • nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327).
  • Fix fruit:time machine max size on arm; (bso#13622)
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294).
  • ctdb: Fix a memleak; (bso#14348).
  • libsmb: Don't try to find posix stat info in SMBC_getatr().
  • ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680).
  • s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095)
  • s3:libads: Fix ads_get_upn(); (bso#14336).
  • CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294)
  • Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).
  • ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324)
• Update to samba 4.11.8
  • CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);
  • CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851);
• Update to samba 4.11.7
  • s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239).
  • s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283)
  • dsdb: Correctly handle memory in objectclass_attrs; (bso#14258).
  • ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270)
  • auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247).
  • smbd: Handle EINTR from open(2) properly; (bso#14285)
  • winbind member (source3) fails local SAM auth with empty domain name; (bso#14247)
  • winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  • lib:util: Log mkdir error on correct debug levels; (bso#14253).
  • wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266).
  • ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274).
• Update to samba…

This update for samba to version 4.10.17 fixes the following issues:

• Fixed net command unable to negotiate SMB2; (bsc#1174120);

• Update to 4.10.17

  • CVE-2020-10745: Invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159).
  • CVE-2020-10760: Fix use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (1173161).
  • CVE-2020-14303: Fix endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined, ldb: Bump version to 1.5.8; (bso#14364); (bsc#1173159).

• Update to 4.10.16 s3: lib: Paranoia around use of snprintf copying into a fixed-size buffer from a getenv() pointer. lib:util: Fix smbclient -l basename dir; (bso#14345). Malicous SMB1 server can crash libsmbclient; (bso#14366). s3:libads: Fix ads_get_upn(); (bso#14336). docs-xml: Fix usernames in pam_winbind manpages; (bso#14358). Client tools are not able to read gencache anymore since 4.10; (bso#14370).

• Update to 4.10.15

  • CVE-2020-10700: Fix use-after-free in AD DC LDAP server when ASQ and paged_results combined; (bso#14331); (bsc#1169850).
  • CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#20454); (bsc#1169851).

• Update to 4.10.14 s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283). nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#20193). dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). auth: Fix CID 1458418 Null pointer dereferences (REVERSE_INULL), auth: Fix CID 1458420 Null pointer dereferences (REVERSE_INULL); (bso#14247). winbind member (source3) fails local SAM auth with empty domain name; (bso#14247). winbindd: Handling missing idmap in getgrgid(); (bso#14265). lib:util: Log mkdir error on correct debug levels; (bso#14253). wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295).

• Update to 4.10.13 s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). s3: libsmb: Ensure return from net_share_enum_rpc() sets cli->raw_status on error; (bso#14176). s3: smbd: SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). s3: smbd: Only set xconn->smb1.negprot.done = true after supported_protocols[protocol].proto_reply_fn() succeeds; (bso#14205). pygpo: Use correct method flags; (bso#14209). s3: Remove now unneeded call to cmdline_messaging_context(); (bso#13925). Incomplete conversion of former parametric options; (bso#14069). Fix sync dosmode fallback in async dosmode codepath; (bso#14070). vfs_fruit returns capped resource fork length; (bso#14171). s3:printing: Fix %J substition; (bso#13745). libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). ctdb-tcp: Close inflight connecting TCP sockets after fork; (bso#14175). s4:dirsync: Fix interaction of dirsync and extended_dn controls; (bso#14153). upgradedns: Ensure lmdb lock files linked; (bso#14199). s3: VFS: glusterfs: Reset nlinks for symlink entries during …

Martin von Wittich and Wilko Meyer discovered that Samba incorrectly handled certain empty UDP packets when being used as a AD DC NBT server. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service.

USN-4454-1 fixed a vulnerability in Samba. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Martin von Wittich and Wilko Meyer discovered that Samba incorrectly handled certain empty UDP packets when being used as a AD DC NBT server. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service.