CVE-2021-20251

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

• CVE-2021-20251: fix race condition in the password lockout code that allowed determined attackers to exceed the configured bad-password count by issuing concurrent authentication / SAMR password-change requests for the same account; the bad-password-count read and the follow-up increment now run under a per-user named mutex in both check_sam_security() and pass_oem_change()

• CVE-2021-20251: fix race condition in the password lockout code that allowed determined attackers to exceed the configured bad-password count by issuing concurrent authentication / SAMR password-change requests for the same account; the bad-password-count read and the follow-up increment now run under a per-user named mutex in both check_sam_security() and pass_oem_change()

• CVE-2021-20251: fix race condition in the password lockout code that allowed determined attackers to exceed the configured bad-password count by issuing concurrent authentication / SAMR password-change requests for the same account; the bad-password-count read and the follow-up increment now run under a per-user named mutex in both check_sam_security() and pass_oem_change()

These are all security issues fixed in the ctdb-4.17.1+git.270.17afe7cb6b-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).
• CVE-2020-14323: Fixed a denial of service in winbindd (bsc#1173994).
• CVE-2022-32742: Fixed incorrect length check in SMB1write, SMB1write_and_close, SMB1write_and_unlock (bsc#1201496).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).

• Updated to version 4.15.13:

  • CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).
  • CVE-2022-37967: Fixed a potential privilege escalation issue via constrained delegation due to weak a cryptographic algorithm being selected (bsc#1205386).
  • CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).

• Updated to version 4.15.12:

  • CVE-2022-42898: Fixed several buffer overflow vulnerabilities on 32-bit systems (bsc#1205126).

• Updated to version 4.15.11:

  • CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3() (bsc#1204254).

• Updated to version 4.15.10:

  • Fixed a potential crash due to a concurrency issue (bsc#1200102).

• Updated to version 4.15.9:

  • CVE-2022-32742: Fixed an information leak that could be triggered via SMB1 (bsc#1201496).
  • CVE-2022-32746: Fixed a memory corruption issue in database audit logging (bsc#1201490).
  • CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
  • CVE-2022-32745: Fixed a remote server crash that could be triggered with certain LDAP requests (bsc#1201492).
  • CVE-2022-32744: Fixed an issue where AD users could have forged password change requests on behalf of other users (bsc#1201493).

Other fixes:

• Fixed a problem when using bind as samba-ad-dc backend related to the named service (bsc#1201689).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password (bsc#1206546).
• CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure channel (bsc#1206504).
• CVE-2022-37966: Fixed an issue where a weak cipher would be selected to encrypt session keys, which could lead to privilege escalation (bsc#1205385).

This update for samba fixes the following issues:

• CVE-2021-20251: Fixed bad password count that was not incremented atomically (bsc#1206546).
• CVE-2022-38023: Fixed weak RC4/HMAC-MD5 NetLogon Secure Channel usage should be avoided (bsc#1206504).
• CVE-2022-37966: Fixed privilege elevation vulnerability with option 'kerberos encryption types = legacy' which would force RC4-HMAC as a client even if the server supports AES (bsc#1205385).

It was discovered that Samba incorrectly handled the bad password count logic. A remote attacker could possibly use this issue to bypass bad passwords lockouts. This issue was only addressed in Ubuntu 22.10. (CVE-2021-20251)

Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2022-3437)

Tom Tervoort discovered that Samba incorrectly used weak rc4-hmac Kerberos keys. A remote attacker could possibly use this issue to elevate privileges. (CVE-2022-37966, CVE-2022-37967)

It was discovered that Samba supported weak RC4/HMAC-MD5 in NetLogon Secure Channel. A remote attacker could possibly use this issue to elevate privileges. (CVE-2022-38023)

Greg Hudson discovered that Samba incorrectly handled PAC parsing. On 32-bit systems, a remote attacker could use this issue to escalate privileges, or possibly execute arbitrary code. (CVE-2022-42898)

Joseph Sutton discovered that Samba could be forced to issue rc4-hmac encrypted Kerberos tickets. A remote attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45141)

WARNING: The fixes included in these updates introduce several important behavior changes which may cause compatibility problems interacting with systems still expecting the former behavior. Please see the following upstream advisories for more information:

https://www.samba.org/samba/security/CVE-2022-37966.html https://www.samba.org/samba/security/CVE-2022-37967.html https://www.samba.org/samba/security/CVE-2022-38023.html