CVE-2019-10218

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.

• CVE-2019-3880: Refuse winreg SaveKey/RestoreKey RPCs to prevent writing registry hive files outside intended share boundaries via symlink races
• CVE-2019-10218: Reject server-supplied filenames containing path separators in SMB1 directory listings to protect libsmbclient consumers from path traversal attacks

• CVE-2019-3880: Refuse winreg SaveKey/RestoreKey RPCs to prevent writing registry hive files outside intended share boundaries via symlink races
• CVE-2019-10218: Reject server-supplied filenames containing path separators in SMB1 directory listings to protect libsmbclient consumers from path traversal attacks
• CVE-2018-1050: Already fixed - upstream patch 0207 applied since the initial import
• CVE-2019-3824: Not affected - the vulnerable ldb_tdb / AD DC code lives in source4, which is not built by this spec (samba_source = source3)

Updated samba packages fix security vulnerabilities:

Malicious servers can cause Samba client code to return filenames containing path separators to calling code (CVE-2019-10218).

When the password contains multi-byte (non-ASCII) characters, the check password script does not receive the full password string (CVE-2019-14833).

Users with the "get changes" extended access right can crash the AD DC LDAP server by requesting an attribute using the range= syntax (CVE-2019-14847).

An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name (CVE-2019-14861).

The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC (CVE-2019-14870).

This update for provides the following fixes:

Following security issues were fixed:

• CVE-2019-14847: User with 'get changes' permission could have crashed AD DC LDAP server via dirsync (bsc#1154598).
• CVE-2019-10218: Client code could have returned filenames containing path separators (bsc#1144902).
• CVE-2019-14833: Accent with 'check script password' where Samba AD DC check password script did not receive the full password (bsc#1154289).

Also following non-security issues were fixed:

• Fix auth problems when printing via smbspool backend with kerberos. (bsc#1148539)
• Fix broken username/password authentication with CUPS and smbspool. (bsc#1152143)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2019-14847: User with 'get changes' permission can crash AD DC LDAP server via dirsync (bsc#1154598).
• CVE-2019-10218: Client code can return filenames containing path separators (bsc#1144902).
• CVE-2019-14833: Fixed Accent with 'check script password' where the Samba AD DC check password script does not receive the full password (bsc#1154289).

Other issues fixed:

• Fix vfs_ceph realpath (bsc#1134452).
• MacOS credit accounting breaks with async SESSION SETUP (bsc#1125601).
• Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection
• Explicitly enable libcephfs POSIX ACL support (bsc#1130245).
• Fix vfs_ceph ftruncate and fallocate handling (bsc#1127153). This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issue:

• CVE-2019-10218: Fixed a path injection caused by filenames containing path separators (bso#14071) (bsc#1144902).

This update for provides the following fixes:

Following security issues were fixed:

• CVE-2019-14847: User with 'get changes' permission could have crashed AD DC LDAP server via dirsync (bsc#1154598).
• CVE-2019-10218: Client code could have returned filenames containing path separators (bsc#1144902).
• CVE-2019-14833: Accent with 'check script password' where Samba AD DC check password script did not receive the full password (bsc#1154289).

Also following non-security issues were fixed:

• Fix auth problems when printing via smbspool backend with kerberos. (bsc#1148539)
• Fix broken username/password authentication with CUPS and smbspool. (bsc#1152143)

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2019-14847: User with 'get changes' permission can crash AD DC LDAP server via dirsync (bsc#1154598).
• CVE-2019-10218: Client code can return filenames containing path separators (bsc#1144902).
• CVE-2019-14833: Fixed Accent with 'check script password' where the Samba AD DC check password script does not receive the full password (bsc#1154289).

Other issues fixed:

• Fix vfs_ceph realpath (bsc#1134452).
• MacOS credit accounting breaks with async SESSION SETUP (bsc#1125601).
• Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection
• Explicitly enable libcephfs POSIX ACL support (bsc#1130245).
• Fix vfs_ceph ftruncate and fallocate handling (bsc#1127153).

This update for samba fixes the following issues:

• CVE-2019-10218: Fixed a path injection caused by filenames containing path separators (bso#14071) (bsc#1144902).

This update for samba fixes the following issues:

• CVE-2019-10218: Client code can return filenames containing path separators (bsc#1144902).

This update for samba fixes the following issue:

• CVE-2019-10218: Fixed a path injection caused by filenames containing path separators (bso#14071) (bsc#1144902).

This update for samba to version 4.10.17 fixes the following issues:

• Fixed net command unable to negotiate SMB2; (bsc#1174120);

• Update to 4.10.17

  • CVE-2020-10745: Invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159).
  • CVE-2020-10760: Fix use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (1173161).
  • CVE-2020-14303: Fix endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359).
  • CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined, ldb: Bump version to 1.5.8; (bso#14364); (bsc#1173159).

• Update to 4.10.16 s3: lib: Paranoia around use of snprintf copying into a fixed-size buffer from a getenv() pointer. lib:util: Fix smbclient -l basename dir; (bso#14345). Malicous SMB1 server can crash libsmbclient; (bso#14366). s3:libads: Fix ads_get_upn(); (bso#14336). docs-xml: Fix usernames in pam_winbind manpages; (bso#14358). Client tools are not able to read gencache anymore since 4.10; (bso#14370).

• Update to 4.10.15

  • CVE-2020-10700: Fix use-after-free in AD DC LDAP server when ASQ and paged_results combined; (bso#14331); (bsc#1169850).
  • CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#20454); (bsc#1169851).

• Update to 4.10.14 s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283). nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#20193). dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). auth: Fix CID 1458418 Null pointer dereferences (REVERSE_INULL), auth: Fix CID 1458420 Null pointer dereferences (REVERSE_INULL); (bso#14247). winbind member (source3) fails local SAM auth with empty domain name; (bso#14247). winbindd: Handling missing idmap in getgrgid(); (bso#14265). lib:util: Log mkdir error on correct debug levels; (bso#14253). wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295).

• Update to 4.10.13 s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). s3: libsmb: Ensure return from net_share_enum_rpc() sets cli->raw_status on error; (bso#14176). s3: smbd: SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). s3: smbd: Only set xconn->smb1.negprot.done = true after supported_protocols[protocol].proto_reply_fn() succeeds; (bso#14205). pygpo: Use correct method flags; (bso#14209). s3: Remove now unneeded call to cmdline_messaging_context(); (bso#13925). Incomplete conversion of former parametric options; (bso#14069). Fix sync dosmode fallback in async dosmode codepath; (bso#14070). vfs_fruit returns capped resource fork length; (bso#14171). s3:printing: Fix %J substition; (bso#13745). libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). ctdb-tcp: Close inflight connecting TCP sockets after fork; (bso#14175). s4:dirsync: Fix interaction of dirsync and extended_dn controls; (bso#14153). upgradedns: Ensure lmdb lock files linked; (bso#14199). s3: VFS: glusterfs: Reset nlinks for symlink entries during …

Michael Hanselmann discovered that the Samba client code incorrectly handled path separators. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause the client to access local pathnames instead of network pathnames. (CVE-2019-10218)

Simon Fonteneau and Björn Baumbach discovered that Samba incorrectly handled the check password script. This issue could possibly bypass custom password complexity checks, contrary to expectations. This issue only affected Ubuntu 18.04 LTS, Ubuntu 19.04, and Ubuntu 19.10. (CVE-2019-14833)

Adam Xu discovered that Samba incorrectly handled the dirsync LDAP control. A remote attacker with "get changes" permissions could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2019-14847)

USN-4167-1 fixed several vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Michael Hanselmann discovered that the Samba client code incorrectly handled path separators. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause the client to access local pathnames instead of network pathnames. (CVE-2019-10218)

Adam Xu discovered that Samba incorrectly handled the dirsync LDAP control. A remote attacker with "get changes" permissions could possibly use this issue to cause Samba to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2019-14847)