CVE-2020-14323

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.13.3). (BZ#1878109)

Security Fix(es):

• samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

• samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

• samba: Unprivileged user can crash winbind (CVE-2020-14323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.13.3). (BZ#1878109)

Security Fix(es):

• samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

• samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

• samba: Unprivileged user can crash winbind (CVE-2020-14323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information (CVE-2020-14318).

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service (CVE-2020-14323).

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service (CVE-2020-14383).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for samba fixes the following issues:

Update to samba 4.11.14

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).
• lib/util: Do not install /usr/bin/test_util
• smbd: don't log success as error
• idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
• winbind: Fix a memleak
• idmap_ad: Pass tldap debug messages on to DEBUG()
• lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE
• ctdb disable/enable can fail due to race condition

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

Update to samba 4.11.14

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).
• lib/util: Do not install /usr/bin/test_util
• smbd: don't log success as error
• idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
• winbind: Fix a memleak
• idmap_ad: Pass tldap debug messages on to DEBUG()
• lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE
• ctdb disable/enable can fail due to race condition

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• Update to 4.13.3

  • libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210);
  • s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486);
  • s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515);
  • s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568);
  • s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590);
  • samba process does not honor max log size; (bso#14248);
  • vfs_zfsacl: Add missing inherited flag on hidden 'magic' everyone@ ACE; (bso#14587);
  • s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  • s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  • smbclient: Fix recursive mget; (bso#14517);
  • clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  • manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486);
  • vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  • interface: Fix if_index is not parsed correctly; (bso#14514);

• Update to 4.13.2

  • s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486);
  • RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);
  • smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538);
  • daemons: Report status to systemd even when running in foreground; (bso#14552);
  • DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553);
  • s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486);
  • provision: Add support for BIND 9.16.x; (bso#14487);
  • ctdb-common: Avoid aliasing errors during code optimization; (bso#14537);
  • libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  • docs: Fix default value of spoolss:architecture; (bso#14522);
  • winbind: Fix a memleak; (bso#14388);
  • s4:dsdb:acl_read: Implement 'List Object' mode feature; (bso#14531);
  • docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486);
  • nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  • vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  • third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  • examples:auth: Do not install example plugin; (bso#14550);
  • ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  • RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);

• Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).

• Update to samba 4.13.1

  • CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472);
  • CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436);
  • CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434);

• Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).
• CVE-2020-14323: Fixed a denial of service in winbindd (bsc#1173994).
• CVE-2022-32742: Fixed incorrect length check in SMB1write, SMB1write_and_close, SMB1write_and_unlock (bsc#1201496).

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information. (CVE-2020-14318)

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service. (CVE-2020-14383)

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information. (CVE-2020-14318)

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service. (CVE-2020-14383)

Peter Eriksson discovered that Samba incorrectly handled certain negative idmap cache entries. This issue could result in certain users gaining unauthorized access to files, contrary to expected behaviour. (CVE-2021-20254)