CVE-2020-25719

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was discovered in the way samba implements SMB1 authentication. Even if Kerberos authentication is required, an attacker can use this flaw to retrieve the clear text password sent over the wire.(CVE-2016-2124)

Several flaws were found in the way that samba AD DC implements storage data access and consistency checking. Attackers can use this flaw to cause damage to the entire domain.(CVE-2020-25722)

A use-after-free issue was found in the Samba AD DC RPC server, which may allow handles to point to different user states, leading to more privileged access.(CVE-2021-3738)

A flaw was found in the way that samba as an AD domain controller can support RODC. This will allow RODC to print administrator credentials.(CVE-2020-25718)

A flaw was discovered in the way that Samba, as an AD domain controller, implements Kerberos name-based authentication. If Samba AD DC does not strictly require Kerberos PAC and always uses the SID found in it, it may not be able to distinguish the user represented by the credential.(CVE-2020-25719)

The AD Kerberos acceptance service in Samba cannot perform authorization by accessing the user's unique and long-term stable identifier.(CVE-2020-25721)

Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

• samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets (CVE-2020-25719)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

• samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets (CVE-2020-25719)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: domain user can become root on a domain member by renaming a machine account
  • debian/patches/CVE-2020-25717.patch: backport the el6/ol6 8-commit subset (samba 3.6.23 precedent); introduce the new "min domain uid" smb.conf parameter (default 1000) and enforce it in check_account() so a domain logon resolving to a uid below the threshold is rejected with NT_STATUS_INVALID_TOKEN, drop the DOMAIN\user to user prefix-stripping fallback in smb_getpwnam(), stop autocreating local users from check_account() and from the kerberos guest fallback by passing create=false, drop the !winbind_ping() branch in create_local_token() so a missing winbindd no longer silently switches the unix-token computation, and require a PAC in any domain mode (DC or member) inside gensec_generate_session_info_pac() returning NT_STATUS_NO_IMPERSONATION_TOKEN otherwise (the gensec hunk is the jointly tagged CVE-2020-25717+CVE-2020-25719 commit, so this update also delivers the member-server portion of CVE-2020-25719; the DC-side portion of CVE-2020-25719 is tracked separately under ELSCVE-104393)
  • CVE-2020-25717
• SECURITY UPDATE: privileged attribute escalation and structural objectclass change in active directory ldap server
  • debian/patches/CVE-2020-25722.patch: in source4/dsdb/samdb/ldb_modules/objectclass.c, capture the current structural objectclass at the start of objectclass_do_mod and reject any modify that would change it; in source4/dsdb/samdb/ldb_modules/samldb.c, factor the domain ntSecurityDescriptor lookup into samldb_get_domain_secdesc() and add samldb_check_sensitive_attributes() invoked from samldb_add() and samldb_modify() to refuse non-system writes to sidHistory, gate msDS-SecondaryKrbTgtNumber on the DS-Install-Replica extended right, and gate msDS-AllowedToDelegateTo on SePrivEnableDelegation
  • CVE-2020-25722

Multiple security issues affecting ldb, samba and sssd. See references for details.

This update for samba and ldb fixes the following issues:

• CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).
• CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
• CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).
• CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

• Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
• Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Address flapping samba_tool_drs_showrepl test;(bso#14818).
• Address flapping dsdb_schema_attributes test;(bso#14819).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

• smbd: panic on force-close share during offload write; (bso#14769).
• Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
• smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
• net conf list crashes when run as normal user;(bso#14787).
• Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
• Start the SMB encryption as soon as possible;(bso#14793).
• Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

• CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)
• CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
• Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

These are all security issues fixed in the ctdb-4.15.2+git.193.a4d6307f1fd-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba and ldb fixes the following issues:

• CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).
• CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
• CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).
• CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

• Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
• Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Address flapping samba_tool_drs_showrepl test;(bso#14818).
• Address flapping dsdb_schema_attributes test;(bso#14819).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

• smbd: panic on force-close share during offload write; (bso#14769).
• Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
• smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
• net conf list crashes when run as normal user;(bso#14787).
• Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
• Start the SMB encryption as soon as possible;(bso#14793).
• Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

• CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)
• CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
• Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

This update for ldb, samba fixes the following issues:

Changes in ldb:

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246)
• CVE-2021-3738: Fixed a crash in dsdb stack (bsc#1192215)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message
• Fix memory handling in ldb.msg_diff
• Backport bronze bit fixes, tests, and selftest improvements.

Changes in samba:

• CVE-2021-44142: Fixed an Out-of-Bound Read/Write on Samba vfs_fruit module; (bsc#1194859)

• The username map [script] advice from CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails; (bsc#1192849); (bso#14901).

• Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);

• CVE-2020-25717: Fixed that a user on the domain can become root on domain members; (bsc#1192284); (bso#14556).

• CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID values; (bsc#1192505); (bso#14564).

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);(bso#14558).

• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given;(bsc#1192247);(bso#14561).

• CVE-2020-25722: Fixed that AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues);(bsc#1192283); (bso#14564).

• CVE-2021-3738: Fixed a crash in dsdb stack;(bsc#1192215); (bso#14468).

• CVE-2021-23192: Fixed that dcerpc requests don't check all fragments against the first auth_state;(bsc#1192214);(bso#14875).

• CVE-2016-2124: don't fallback to non spnego authentication if we require kerberos; (bsc#1014440); (bso#12444).

Update to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

• Update to 4.13.12

  • Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
  • Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Address flapping samba_tool_drs_showrepl test;(bso#14818).
  • Address flapping dsdb_schema_attributes test;(bso#14819).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Fix CTDB flag/status update race conditions(bso#14784).

• Update to 4.13.11

  • smbd: panic on force-close share during offload write; (bso#14769).
  • Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
  • smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
  • net conf list crashes when run as normal user;(bso#14787).
  • Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
  • Start the SMB encryption as soon as possible;(bso#14793).
  • Winbind should not start if the socket path for the…

Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote attacker could possibly use this issue to downgrade connections to plaintext authentication. (CVE-2016-2124)

Andrew Bartlett discovered that Samba incorrectly mapping domain users to local users. An authenticated attacker could possibly use this issue to become root on domain members. (CVE-2020-25717)

Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos tickets issues by an RODC. An RODC could print administrator tickets, contrary to expectations. (CVE-2020-25718)

Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets. Delegated administrators could possibly use this issue to impersonate accounts, leading to total domain compromise. (CVE-2020-25719)

Andrew Bartlett discovered that Samba did not provide stable AD identifiers to Kerberos acceptors. (CVE-2020-25721)

Andrew Bartlett discovered that Samba did not properly check sensitive attributes. An authenticated attacker could possibly use this issue to escalate privileges. (CVE-2020-25722)

Stefan Metzmacher discovered that Samba incorrectly handled certain large DCE/RPC requests. A remote attacker could possibly use this issue to bypass signature requirements. (CVE-2021-23192)

William Ross discovered that Samba incorrectly handled memory. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly escalate privileges. (CVE-2021-3738)

Joseph Sutton discovered that Samba incorrectly handled certain TGS requests. An authenticated attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2021-3671)

The fix for CVE-2020-25717 results in possible behaviour changes that could affect certain environments. Please see the upstream advisory for more information:

https://www.samba.org/samba/security/CVE-2020-25717.html