CVE-2021-20277

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.(CVE-2021-20254)

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.(CVE-2021-20277)

A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.(CVE-2020-27840)

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.

A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability (CVE-2020-27840).

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2021-20254).

A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability (CVE-2021-20277).

Also, the samba package for Mageia 7 fixes a scriplet issue when updating.

Additionally, the sssd package has been rebuilt for the updated ldb package.

This update for ldb fixes the following issues:

• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• s3-libads: use dns name to open a ldap session (bsc#1184310).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).

• Spec file fixes around systemd and requires (bsc#1182830)

• Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875)

• Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875)

• CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690);
• CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859);
• CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);

samba was updated to 4.15.4 (jsc#SLE-23329);

• Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928);
• Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
• kill_tcp_connections does not work; (bso#14934);
• Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935);
• smbclient -L doesn't set 'client max protocol' to NT1 before calling the 'Reconnecting with SMB1 for workgroup listing' path; (bso#14939);
• Cross device copy of the crossrename module always fails; (bso#14940);
• symlinkat function from VFS cap module always fails with an error; (bso#14941);
• Fix possible fsp pointer deference; (bso#14942);
• Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944);
• 'smbd --build-options' no longer works without an smb.conf file; (bso#14945);

Samba was updated to version 4.15.3

• CVE-2021-43566: Symlink race error can allow directory creation outside of the exported share; (bsc#1139519);
• CVE-2021-20316: Symlink race error can allow metadata read and modify outside of the exported share; (bsc#1191227);

• Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel.
• Rename package samba-core-devel to samba-devel
• Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba

krb5 was updated to 1.16.3 to 1.19.2

• Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222);
• Fix a memory leak when gss_inquire_cred() is called without a credential handle.

Changes from 1.19.1:

• Fix a linking issue with Samba.
• Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value.

Changes from 1.19

Administrator experience

• When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually.
• It is now harder to accidentally delete the K/M entry from a KDB. Developer experience
• gss_acquire_cred_from() now supports the 'password' and 'verify' options, allowing credentials to be acquired via password and verified using a keytab key.
• When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings.
• Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate.
• PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets.
• The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution
• Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support.
• kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a…

These are all security issues fixed in the ldb-tools-2.3.0-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ldb fixes the following issues:

• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

This update for ldb fixes the following issues:

• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

This update for ldb, samba fixes the following issues:

• ldb was updated to 2.2.1

  • CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
  • CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
  • CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).

• samba was updated to 4.13.6

  • CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
  • CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
  • CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
  • Spec file fixes around systemd and requires; (bsc#1182830);

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• s3-libads: use dns name to open a ldap session (bsc#1184310).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).
• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).
• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).
• Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).
• s3-libads: use dns name to open a ldap session (bsc#1184310).
• Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

This update for samba fixes the following issues:

• CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

• CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

• CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).

• Spec file fixes around systemd and requires (bsc#1182830)

• Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875)

• Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875)

• CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690);
• CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859);
• CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);

samba was updated to 4.15.4 (jsc#SLE-23329);

• Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928);
• Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
• kill_tcp_connections does not work; (bso#14934);
• Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935);
• smbclient -L doesn't set 'client max protocol' to NT1 before calling the 'Reconnecting with SMB1 for workgroup listing' path; (bso#14939);
• Cross device copy of the crossrename module always fails; (bso#14940);
• symlinkat function from VFS cap module always fails with an error; (bso#14941);
• Fix possible fsp pointer deference; (bso#14942);
• Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944);
• 'smbd --build-options' no longer works without an smb.conf file; (bso#14945);

Samba was updated to version 4.15.3

• CVE-2021-43566: Symlink race error can allow directory creation outside of the exported share; (bsc#1139519);
• CVE-2021-20316: Symlink race error can allow metadata read and modify outside of the exported share; (bsc#1191227);

• Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel.
• Rename package samba-core-devel to samba-devel
• Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba

krb5 was updated to 1.16.3 to 1.19.2

• Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222);
• Fix a memory leak when gss_inquire_cred() is called without a credential handle.

Changes from 1.19.1:

• Fix a linking issue with Samba.
• Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value.

Changes from 1.19

Administrator experience

• When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually.
• It is now harder to accidentally delete the K/M entry from a KDB. Developer experience
• gss_acquire_cred_from() now supports the 'password' and 'verify' options, allowing credentials to be acquired via password and verified using a keytab key.
• When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings.
• Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate.
• PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets.
• The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution
• Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support.
• kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a…

Douglas Bagnall discovered that ldb, when used with Samba, incorrectly handled certain LDAP attributes. A remote attacker could possibly use this issue to cause the LDAP server to crash, resulting in a denial of service. (CVE-2021-20277)

Douglas Bagnall discovered that ldb, when used with Samba, incorrectly handled certain DN strings. A remote attacker could use this issue to cause the LDAP server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-27840)

USN-4888-1 fixed several vulnerabilities in ldb. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Douglas Bagnall discovered that ldb, when used with Samba, incorrectly handled certain LDAP attributes. A remote attacker could possibly use this issue to cause the LDAP server to crash, resulting in a denial of service. (CVE-2021-20277)

Douglas Bagnall discovered that ldb, when used with Samba, incorrectly handled certain DN strings. A remote attacker could use this issue to cause the LDAP server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-27840)