CVE-2021-20254

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.(CVE-2021-20254)

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.(CVE-2021-20277)

A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.(CVE-2020-27840)

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token (CVE-2021-20254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token (CVE-2021-20254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability (CVE-2020-27840).

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2021-20254).

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability (CVE-2021-20277).

Also, the samba package for Mageia 7 fixes a scriplet issue when updating.

Additionally, the sssd package has been rebuilt for the updated ldb package.

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• s3-libads: use dns name to open a ldap session (bsc#1184310).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).

• Spec file fixes around systemd and requires (bsc#1182830)

• Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875)

• Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875)

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for ldb, samba fixes the following issues:

• ldb was updated to 2.2.1

  • CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
  • CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
  • CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).

• samba was updated to 4.13.6

  • CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
  • CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
  • CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
  • Spec file fixes around systemd and requires; (bsc#1182830);

This update for samba fixes the following issues:

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• s3-libads: use dns name to open a ldap session (bsc#1184310).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• s3-libads: use dns name to open a ldap session (bsc#1184310).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).

• Spec file fixes around systemd and requires (bsc#1182830)

• Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875)

• Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875)

This update for ldb, samba fixes the following issues:

Changes in ldb:

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246)
• CVE-2021-3738: Fixed a crash in dsdb stack (bsc#1192215)

Release ldb 2.2.2

• Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message
• Fix memory handling in ldb.msg_diff
• Backport bronze bit fixes, tests, and selftest improvements.

Changes in samba:

• CVE-2021-44142: Fixed an Out-of-Bound Read/Write on Samba vfs_fruit module; (bsc#1194859)

• The username map [script] advice from CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails; (bsc#1192849); (bso#14901).

• Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);

• CVE-2020-25717: Fixed that a user on the domain can become root on domain members; (bsc#1192284); (bso#14556).

• CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID values; (bsc#1192505); (bso#14564).

• CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);(bso#14558).

• CVE-2020-25719: Fixed AD DC Username based races when no PAC is given;(bsc#1192247);(bso#14561).

• CVE-2020-25722: Fixed that AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues);(bsc#1192283); (bso#14564).

• CVE-2021-3738: Fixed a crash in dsdb stack;(bsc#1192215); (bso#14468).

• CVE-2021-23192: Fixed that dcerpc requests don't check all fragments against the first auth_state;(bsc#1192214);(bso#14875).

• CVE-2016-2124: don't fallback to non spnego authentication if we require kerberos; (bsc#1014440); (bso#12444).

Update to 4.13.13

• rodc_rwdc test flaps;(bso#14868).
• Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
• Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• 'in' operator on ldb.Message is case sensitive;(bso#14845).
• Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
• Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
• Fix transit path validation;(bso#12998).
• Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
• rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
• Python ldb.msg_diff() memory handling failure;(bso#14836).
• Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

• Update to 4.13.12

  • Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
  • Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Address flapping samba_tool_drs_showrepl test;(bso#14818).
  • Address flapping dsdb_schema_attributes test;(bso#14819).
  • An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
  • Fix CTDB flag/status update race conditions(bso#14784).

• Update to 4.13.11

  • smbd: panic on force-close share during offload write; (bso#14769).
  • Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
  • smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
  • net conf list crashes when run as normal user;(bso#14787).
  • Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
  • Start the SMB encryption as soon as possible;(bso#14793).
  • Winbind should not start if the socket path for the…

Peter Eriksson discovered that Samba incorrectly handled certain negative idmap cache entries. This issue could result in certain users gaining unauthorized access to files, contrary to expected behaviour.

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information. (CVE-2020-14318)

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service. (CVE-2020-14383)

Peter Eriksson discovered that Samba incorrectly handled certain negative idmap cache entries. This issue could result in certain users gaining unauthorized access to files, contrary to expected behaviour. (CVE-2021-20254)