CVE-2020-14383

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information (CVE-2020-14318).

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service (CVE-2020-14323).

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service (CVE-2020-14383).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for samba fixes the following issues:

Update to samba 4.11.14

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).
• lib/util: Do not install /usr/bin/test_util
• smbd: don't log success as error
• idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
• winbind: Fix a memleak
• idmap_ad: Pass tldap debug messages on to DEBUG()
• lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE
• ctdb disable/enable can fail due to race condition

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

Update to samba 4.11.14

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).
• lib/util: Do not install /usr/bin/test_util
• smbd: don't log success as error
• idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
• winbind: Fix a memleak
• idmap_ad: Pass tldap debug messages on to DEBUG()
• lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE
• ctdb disable/enable can fail due to race condition

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• Update to 4.13.3

  • libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210);
  • s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486);
  • s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515);
  • s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568);
  • s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590);
  • samba process does not honor max log size; (bso#14248);
  • vfs_zfsacl: Add missing inherited flag on hidden 'magic' everyone@ ACE; (bso#14587);
  • s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  • s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  • smbclient: Fix recursive mget; (bso#14517);
  • clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  • manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486);
  • vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  • interface: Fix if_index is not parsed correctly; (bso#14514);

• Update to 4.13.2

  • s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486);
  • RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);
  • smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538);
  • daemons: Report status to systemd even when running in foreground; (bso#14552);
  • DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553);
  • s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486);
  • provision: Add support for BIND 9.16.x; (bso#14487);
  • ctdb-common: Avoid aliasing errors during code optimization; (bso#14537);
  • libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  • docs: Fix default value of spoolss:architecture; (bso#14522);
  • winbind: Fix a memleak; (bso#14388);
  • s4:dsdb:acl_read: Implement 'List Object' mode feature; (bso#14531);
  • docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486);
  • nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  • vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  • third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  • examples:auth: Do not install example plugin; (bso#14550);
  • ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  • RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);

• Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).

• Update to samba 4.13.1

  • CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472);
  • CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436);
  • CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434);

• Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information. (CVE-2020-14318)

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service. (CVE-2020-14383)

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information. (CVE-2020-14318)

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service. (CVE-2020-14383)

Peter Eriksson discovered that Samba incorrectly handled certain negative idmap cache entries. This issue could result in certain users gaining unauthorized access to files, contrary to expected behaviour. (CVE-2021-20254)