CVE-2020-25721

Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was discovered in the way samba implements SMB1 authentication. Even if Kerberos authentication is required, an attacker can use this flaw to retrieve the clear text password sent over the wire.(CVE-2016-2124)

Several flaws were found in the way that samba AD DC implements storage data access and consistency checking. Attackers can use this flaw to cause damage to the entire domain.(CVE-2020-25722)

A use-after-free issue was found in the Samba AD DC RPC server, which may allow handles to point to different user states, leading to more privileged access.(CVE-2021-3738)

A flaw was found in the way that samba as an AD domain controller can support RODC. This will allow RODC to print administrator credentials.(CVE-2020-25718)

A flaw was discovered in the way that Samba, as an AD domain controller, implements Kerberos name-based authentication. If Samba AD DC does not strictly require Kerberos PAC and always uses the SID found in it, it may not be able to distinguish the user represented by the credential.(CVE-2020-25719)

The AD Kerberos acceptance service in Samba cannot perform authorization by accessing the user's unique and long-term stable identifier.(CVE-2020-25721)

Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.

Multiple security issues affecting ldb, samba and sssd. See references for details.

This update for samba and ldb fixes the following issues:

• CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).
• CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
• CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).
• CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

• Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
• Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Address flapping samba_tool_drs_showrepl test;(bso#14818).
• Address flapping dsdb_schema_attributes test;(bso#14819).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

• smbd: panic on force-close share during offload write; (bso#14769).
• Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
• smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
• net conf list crashes when run as normal user;(bso#14787).
• Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
• Start the SMB encryption as soon as possible;(bso#14793).
• Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

• CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)
• CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
• Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

These are all security issues fixed in the ctdb-4.15.2+git.193.a4d6307f1fd-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba and ldb fixes the following issues:

• CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).
• CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
• CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
• CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
• CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).
• CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).
• CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

• Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
• Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Address flapping samba_tool_drs_showrepl test;(bso#14818).
• Address flapping dsdb_schema_attributes test;(bso#14819).
• An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
• Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

• smbd: panic on force-close share during offload write; (bso#14769).
• Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
• smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
• net conf list crashes when run as normal user;(bso#14787).
• Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
• Start the SMB encryption as soon as possible;(bso#14793).
• Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

• CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)
• CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
• Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

This update contains a major security update for Samba.

samba has received security fixes:

• CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share (bsc#1193690);
• CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution (bsc#1194859);
• CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services (bsc#1195048);

samba was updated to version 4.15.4; (jsc#SLE-23330);

• CVE-2021-43566: Symlink race error can allow directory creation outside of the exported share; (bso#13979); (bsc#1139519);
• CVE-2021-20316: Symlink race error can allow metadata read and modify outside of the exported share; (bso#14842); (bsc#1191227);

• Build samba with embedded talloc, pytalloc, pytalloc-util, tdb, pytdb, tevent, pytevent, ldb, pyldb and pyldb-util libraries. The tdb and ldb tools are installed in /usr/lib[64]/samba/bin and their manpages in /usr/lib[64]/samba/man

  This avoids removing old functionality.

samba was updated to 4.15.4:

• Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928);
• Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
• kill_tcp_connections does not work; (bso#14934);
• Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935);
• smbclient -L doesn't set 'client max protocol' to NT1 before calling the 'Reconnecting with SMB1 for workgroup listing' path; (bso#14939);
• Cross device copy of the crossrename module always fails; (bso#14940);
• symlinkat function from VFS cap module always fails with an error; (bso#14941);
• Fix possible fsp pointer deference; (bso#14942);
• Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944);
• 'smbd --build-options' no longer works without an smb.conf file; (bso#14945);

• Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel.
• Rename package samba-core-devel to samba-devel
• Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba

sssd was updated:

• Build with the newer samba versions; (jsc#SLE-23330);
• Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058);

p11-kit was updated:

Update to 0.23.2; (jsc#SLE-23330);

• Fix forking issues with libffi
• Fix various crashes in corner cases
• Updated translations
• Build fixes

• Fix multiple integer overflows in rpc code (bsc#1180064 CVE-2020-29361):
• Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993)

ca-certificates was updated:

• p11-kit 0.23.1 supports pem-directory-hash. (jsc#SLE-23330)

This update also ships:

• libnettle 3.1 and gnutls 3.4.17 as parallel libraries to meet the requires of the newer samba.

apparmor was updated:

• Update samba apparmor profiles for samba 4.15 (jsc#SLE-23330);

yast2-samba-client was updated:

• With latest versions of samba (>=4.15.0) calling 'net ads lookup' with '-U%' fails; (boo#1193533).
• yast-samba-client fails to join if /etc/samba/smb.conf or /etc/krb5.conf don't exist; (bsc#1089938)
• Do not stop nmbd while nmbstatus is running, it is not necessary anymore; (bsc#1158916);

This update for ldb, samba fixes the following issues:

Changes in ldb:

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246)
• CVE-2021-3738: Fixed a crash in dsdb stack (bsc#1192215)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message
• Fix memory handling in ldb.msg_diff
• Backport bronze bit fixes, tests, and selftest improvements.

Changes in samba:

• CVE-2021-44142: Fixed an Out-of-Bound Read/Write on Samba vfs_fruit module; (bsc#1194859)

• The username map [script] advice from CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails; (bsc#1192849); (bso#14901).

• Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);

• CVE-2020-25717: Fixed that a user on the domain can become root on domain members; (bsc#1192284); (bso#14556).

• CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID values; (bsc#1192505); (bso#14564).

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);(bso#14558).

• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given;(bsc#1192247);(bso#14561).

• CVE-2020-25722: Fixed that AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues);(bsc#1192283); (bso#14564).

• CVE-2021-3738: Fixed a crash in dsdb stack;(bsc#1192215); (bso#14468).

• CVE-2021-23192: Fixed that dcerpc requests don't check all fragments against the first auth_state;(bsc#1192214);(bso#14875).

• CVE-2016-2124: don't fallback to non spnego authentication if we require kerberos; (bsc#1014440); (bso#12444).

Update to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

• Update to 4.13.12

  • Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
  • Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Address flapping samba_tool_drs_showrepl test;(bso#14818).
  • Address flapping dsdb_schema_attributes test;(bso#14819).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Fix CTDB flag/status update race conditions(bso#14784).

• Update to 4.13.11

  • smbd: panic on force-close share during offload write; (bso#14769).
  • Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
  • smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
  • net conf list crashes when run as normal user;(bso#14787).
  • Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
  • Start the SMB encryption as soon as possible;(bso#14793).
  • Winbind should not start if the socket path for the…

Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote attacker could possibly use this issue to downgrade connections to plaintext authentication. (CVE-2016-2124)

Andrew Bartlett discovered that Samba incorrectly mapping domain users to local users. An authenticated attacker could possibly use this issue to become root on domain members. (CVE-2020-25717)

Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos tickets issues by an RODC. An RODC could print administrator tickets, contrary to expectations. (CVE-2020-25718)

Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets. Delegated administrators could possibly use this issue to impersonate accounts, leading to total domain compromise. (CVE-2020-25719)

Andrew Bartlett discovered that Samba did not provide stable AD identifiers to Kerberos acceptors. (CVE-2020-25721)

Andrew Bartlett discovered that Samba did not properly check sensitive attributes. An authenticated attacker could possibly use this issue to escalate privileges. (CVE-2020-25722)

Stefan Metzmacher discovered that Samba incorrectly handled certain large DCE/RPC requests. A remote attacker could possibly use this issue to bypass signature requirements. (CVE-2021-23192)

William Ross discovered that Samba incorrectly handled memory. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly escalate privileges. (CVE-2021-3738)

Joseph Sutton discovered that Samba incorrectly handled certain TGS requests. An authenticated attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2021-3671)

The fix for CVE-2020-25717 results in possible behaviour changes that could affect certain environments. Please see the upstream advisory for more information:

https://www.samba.org/samba/security/CVE-2020-25717.html