The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.

The remote host is affected by the vulnerability described in GLSA-201612-47 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with root       privileges, cause a Denial of Service condition, conduct a       man-in-the-middle attack, obtain sensitive information, or bypass file       permissions.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of Samba is 4.x earlier than 4.1.22.  It is therefore affected by the following vulnerabilities :

 - A flaw exists in the 'ldb_wildcard_compare()' function in 'lib/ldb/common/ldb_match.c' that is triggered when handling LDAP requests.  This may allow a remote attacker to exhaust available CPU resources. (CVE-2015-3223)
 - A flaw exists in the 'check_reduced_name_with_privilege()' and 'check_reduced_name()' functions in 'smbd/vfs.c' that allows traversing outside of a restricted path.  The issue is due to users being permitted to follow symlinks pointing to resources in another directory that shares a common path prefix.  This may allow a remote attacker to access files outside the exported share path.  According to the vendor, exploitation requires that a Samba share "is configured with a path that shares a common path prefix with another directory on the file system". (CVE-2015-5252)
 - A flaw exists that is triggered when handling encrypted client sessions due to missing signing.  This may allow a Man-in-the-Middle (MitM) attacker to downgrade the security of the connection, making it easier to break the encryption and monitor or manipulate communication. (CVE-2015-5296)
 - A flaw exists in the 'shadow_copy2_get_shadow_copy_data()' function in 'modules/vfs_shadow_copy2.c' due to missing access control checks when accessing snapshots.  This may allow an authenticated, remote attacker to gain knowledge of potentially sensitive information. (CVE-2015-5299)
 - An unspecified flaw exists that is triggered when handling LDAP requests.  This may allow a remote attacker to disclose uninitialized memory contents. (CVE-2015-5330)
 - A flaw exists in 'libcli/ldap/ldap_message.c' that is triggered when handling LDAP requests.  This may allow a remote attacker to exhaust available memory resources and potentially cause the process to be terminated. (CVE-2015-7540)
 - A flaw exists in the 'samldb_check_user_account_control_acl()' function in 'dsdb/samdb/ldb_modules/samldb.c' that is triggered when operating as an Active Directory domain controller.  This may allow a remote attacker to bypass a certain Microsoft patch for Windows AD DCs in the same domain and crash them.  (CVE-2015-8467)

According to its banner, the version of Samba running on the remote host is 4.2.x prior to 4.2.7 or 4.3.x prior to 4.3.3. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     ldb_wildcard_compare() function in file ldb_match.c due     to mishandling certain zero values. An unauthenticated,     remote attacker can exploit this, via crafted LDAP     requests, to exhaust CPU resources. (CVE-2015-3223)

  - A security bypass vulnerability exists in the     check_reduced_name_with_privilege() function and the     check_reduced_name() function within file smbd/vfs.c     that allows users to follow symlinks that point to     resources in another directory that shares a common path     prefix. An unauthenticated, remote attacker can exploit     this, via a symlink that points outside of a share, to     bypass file access restrictions. (CVE-2015-5252)

  - A flaw exists due to a failure to ensure that signing is     negotiated when creating encrypted connections between     the client and server. A man-in-the-middle attacker can     exploit this, by modifying the client-server data     stream, to downgrade the security of the connection,     thus allowing communications to be monitored or     manipulated. (CVE-2015-5296)

  - A security bypass vulnerability exists in the     shadow_copy2_get_shadow_copy_data() function in file     modules/vfs_shadow_copy2.c due to a failure to verify     that DIRECTORY_LIST access rights has been granted when     accessing snapshots. An unauthenticated, remote attacker     can exploit this to access snapshots by visiting a     shadow copy directory. (CVE-2015-5299)

  - A flaw exists in the LDAP server due to improper     handling of string lengths in LDAP requests. An     unauthenticated, remote attacker can exploit this to     gain sensitive information from the daemon heap memory     by sending crafted packets and then reading an error     message or a database value. (CVE-2015-5330)

  - The samldb_check_user_account_control_acl() function     in file dsdb/samdb/ldb_modules/samldb.c fails to     properly check for administrative privileges during the     creation of machine accounts. An authenticated, remote     attacker can exploit this to bypass intended access     restrictions by making use of a domain that has both     a Samba DC and Windows DC. (CVE-2015-8467)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Samba running on the remote host is 4.x prior to 4.1.22. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     ldb_wildcard_compare() function in file ldb_match.c due     to mishandling certain zero values. An unauthenticated,     remote attacker can exploit this, via crafted LDAP     requests, to exhaust CPU resources. (CVE-2015-3223)

  - A security bypass vulnerability exists in the     check_reduced_name_with_privilege() function and the     check_reduced_name() function within file smbd/vfs.c     that allows users to follow symlinks that point to     resources in another directory that shares a common path     prefix. An unauthenticated, remote attacker can exploit     this, via a symlink that points outside of a share, to     bypass file access restrictions. (CVE-2015-5252)

  - A flaw exists due to a failure to ensure that signing is     negotiated when creating encrypted connections between     the client and server. A man-in-the-middle attacker can     exploit this, by modifying the client-server data     stream, to downgrade the security of the connection,     thus allowing communications to be monitored or     manipulated. (CVE-2015-5296)

  - A security bypass vulnerability exists in the     shadow_copy2_get_shadow_copy_data() function in file     modules/vfs_shadow_copy2.c due to a failure to verify     that DIRECTORY_LIST access rights has been granted when     accessing snapshots. An unauthenticated, remote attacker     can exploit this to access snapshots by visiting a     shadow copy directory. (CVE-2015-5299)

  - A flaw exists in the LDAP server due to improper     handling of string lengths in LDAP requests. An     unauthenticated, remote attacker can exploit this to     gain sensitive information from the daemon heap memory     by sending crafted packets and then reading an error     message or a database value. (CVE-2015-5330)

  - A denial of service vulnerability exists in the LDAP     server due to a failure to check return values when     allocating ASN.1 memory. An unauthenticated, remote     attacker can exploit this, via crafted packets, to     cause the daemon to crash through memory consumption.
    (CVE-2015-7540)

  - The samldb_check_user_account_control_acl() function     in file dsdb/samdb/ldb_modules/samldb.c fails to     properly check for administrative privileges during the     creation of machine accounts. An authenticated, remote     attacker can exploit this to bypass intended access     restrictions by making use of a domain that has both     a Samba DC and Windows DC. (CVE-2015-8467)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2855-1 advisory.

    Thilo Uttendorfer discovered that the Samba LDAP server incorrectly handled certain packets. A remote     attacker could use this issue to cause the LDAP server to stop responding, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-3223)

    Jan Kasprzak discovered that Samba incorrectly handled certain symlinks. A remote attacker could use this     issue to access files outside the exported share path. (CVE-2015-5252)

    Stefan Metzmacher discovered that Samba did not enforce signing when creating encrypted connections. If a     remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view     sensitive information. (CVE-2015-5296)

    It was discovered that Samba incorrectly performed access control when using the VFS shadow_copy2 module.
    A remote attacker could use this issue to access snapshots, contrary to intended permissions.
    (CVE-2015-5299)

    Douglas Bagnall discovered that Samba incorrectly handled certain string lengths. A remote attacker could     use this issue to possibly access sensitive information. (CVE-2015-5330)

    It was discovered that the Samba LDAP server incorrectly handled certain packets. A remote attacker could     use this issue to cause the LDAP server to stop responding, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-7540)

    Andrew Bartlett discovered that Samba incorrectly checked administrative privileges during creation of     machine accounts. A remote attacker could possibly use this issue to bypass intended access restrictions     in certain environments. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10.
    (CVE-2015-8467)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2015-3223     Thilo Uttendorfer of Linux Information Systems AG     discovered that a malicious request can cause the Samba     LDAP server to hang, spinning using CPU. A remote     attacker can take advantage of this flaw to mount a     denial of service.

  - CVE-2015-5252     Jan 'Yenya' Kasprzak and the Computer Systems Unit team     at Faculty of Informatics, Masaryk University discovered     that insufficient symlink verification could allow data     access outside an exported share path.

  - CVE-2015-5296     Stefan Metzmacher of SerNet discovered that Samba does     not ensure that signing is negotiated when creating an     encrypted client connection to a server. This allows a     man-in-the-middle attacker to downgrade the connection     and connect using the supplied credentials as an     unsigned, unencrypted connection.

  - CVE-2015-5299     It was discovered that a missing access control check in     the VFS shadow_copy2 module could allow unauthorized     users to access snapshots.

  - CVE-2015-5330     Douglas Bagnall of Catalyst discovered that the Samba     LDAP server is vulnerable to a remote memory read     attack. A remote attacker can obtain sensitive     information from daemon heap memory by sending crafted     packets and then either read an error message, or a     database value.

  - CVE-2015-7540     It was discovered that a malicious client can send     packets that cause the LDAP server provided by the AD DC     in the samba daemon process to consume unlimited memory     and be terminated.

  - CVE-2015-8467     Andrew Bartlett of the Samba Team and Catalyst     discovered that a Samba server deployed as an AD DC can     expose Windows DCs in the same domain to a denial of     service via the creation of multiple machine accounts.
    This issue is related to the MS15-096 / CVE-2015-2535     security issue in Windows.

This update for ldb, samba, talloc, tdb, tevent fixes the following issues :

ldb was updated to 1.1.24.

  + Fix ldap \00 search expression attack dos;
    cve-2015-3223; (bso#11325)

  + Fix remote read memory exploit in ldb; cve-2015-5330;
    (bso#11599)

  + Move ldb_(un)pack_data into ldb_module.h for testing

  + Fix installation of _ldb_text.py

  + Fix propagation of ldb errors through tdb

  + Fix bug triggered by having an empty message in database     during search

  + Test improvements

  + Improved python bindings

  + Validate_ldb of string(generalized-time) does not accept     millisecond format '.000Z'; (bso#9810)

  + Fix logic in ldb_val_to_time()

  + Allow to register extended match rules

  + Fixes for segfaults in pyldb

  + Documentation fixes

  + Build system improvements

  + Fix a typo in the comment, ldb_flags_mod_xxx ->     ldb_flag_mod_xxx

  + Fix check for third_party

  + Make the successful ldb_transaction_start() message     clearer

  + Ldb-samba: fix a memory leak in     ldif_canonicalise_objectcategory()

  + Ldb-samba: move pyldb-utils dependency to     python_samba__ldb

  + Build: improve detection of srcdir

Samba was updated to 4.1.22.

  + Malicious request can cause samba ldap server to hang,     spinning using cpu; CVE-2015-3223; (bso#11325);
    (boo#958581).

  + Remote read memory exploit in ldb; cve-2015-5330;
    (bso#11599); (boo#958586).

  + Insufficient symlink verification (file access outside     the share); CVE-2015-5252; (bso#11395); (boo#958582).

  + No man in the middle protection when forcing smb     encryption on the client side; CVE-2015-5296;
    (bso#11536); (boo#958584).

  + Currently the snapshot browsing is not secure thru     windows previous version (shadow_copy2); CVE-2015-5299;
    (bso#11529); (boo#958583).

  + Fix microsoft ms15-096 to prevent machine accounts from     being changed into user accounts; CVE-2015-8467;
    (bso#11552); (boo#958585).

  + Fix remote dos in samba (ad) ldap server; cve-2015-7540;
    (bso#9187); (boo#958580).

  + Ensure attempt to ssh into locked account triggers 'Your     account is disabled.....' to the console; (boo#953382).

  + Prevent NULL pointer access in samlogon fallback when     security credentials are null; (boo#949022).

talloc was updated to 2.1.5; (boo#954658).

  + Minor build fixes

  + Point ld_library_path to the just-built libraries while     calling make test.

  + Disable rpath-install and silent-rules while configure.

  + Update to 2.1.4; (boo#951660).

  + Test that talloc magic differs between processes.

  + Increment minor version due to added     talloc_test_get_magic.

  + Provide tests access to talloc_magic.

  + Test magic protection measures.

  + Update the samba library distribution key file     'talloc.keyring'; (bso#945116).

  + Update to 2.1.3; (boo#939051).

  + Improved python3 bindings

  + Documentation fixes regarding talloc_reference() and     talloc_unlink()

tdb was updated to version 1.3.8; (boo#954658).

  + Fix broken build with --disable-python

  + Minor build fixes

  + Disable rpath-install and silent-rules while configure.

  + Update the samba library distribution key file     'tdb.keyring'; (bso#945116).

  + Update to version 1.3.7.

  + First fix deadlock in the interaction between fcntl and     mutex locking; (bso#11381)

  + Improved python3 bindings

  + Update to version 1.3.6.

  + Fix runtime detection for robust mutexes in the     standalone build; (bso#11326).

  + Possible fix for the build with robust mutexes on     solaris 11; (bso#11319).

  + Update to version 1.3.5.

  + Abi change: tdb_chainlock_read_nonblock() has been     added, a nonblock variant of tdb_chainlock_read()

  + Do not build test binaries if it's not a standalone     build

  + Fix cid 1034842 resource leak

  + Fix cid 1034841 resource leak

  + Don't let tdb_wrap_open() segfault with name==null

  + Update to version 1.3.4.

  + Toos: allow transactions with tdb_mutex_locking

  + Test: add tdb1-run-mutex-transaction1 test

  + Allow transactions on on tdb's with tdb_mutex_locking

  + Update to version 1.3.3.

  + Test: tdb_clear_if_first | tdb_mutex_locking, o_rdonly     is a valid combination

  + Update to version 1.3.2.

  + Allow tdb_open_ex() with o_rdonly of     tdb_feature_flag_mutex tdbs.

  + Fix a comment

  + Fix tdb_runtime_check_for_robust_mutexes()

  + Improve wording in a comment

  + Tdb.h needs bool type; obsoletes     include_stdbool_bso10625.patch

  + Tdb_wrap: make mutexes easier to use

  + Tdb_wrap: only pull in samba-debug

  + Tdb_wrap: standalone compile without includes.h

  + Tdb_wrap: tdb_wrap.h doesn't need struct     loadparm_context

  - Update to version 1.3.1.

  + Tools: fix a compiler warning

  + Defragment the freelist in tdb_allocate_from_freelist()

  + Add 'freelist_size' sub-command to tdbtool

  + Use tdb_freelist_merge_adjacent in tdb_freelist_size()

  + Add tdb_freelist_merge_adjacent()

  + Add utility function check_merge_ptr_with_left_record()

  + Simplify tdb_free() using check_merge_with_left_record()

  + Add utility function check_merge_with_left_record()

  + Improve comments for tdb_free().

  + Factor merge_with_left_record() out of tdb_free()

  + Fix debug message in tdb_free()

  + Reduce indentation in tdb_free() for merging left

  + Increase readability of read_record_on_left()

  + Factor read_record_on_left() out of tdb_free()

  + Build: improve detection of srcdir.

tevent was update to version 0.9.26; (boo#954658).

  + New tevent_thread_proxy api

  + Minor build fixes

  + Update the samba library distribution key file     'tevent.keyring'; (bso#945116).

  + Update to 0.9.25.

  + Fix compile error in solaris ports backend.

  + Fix access after free in tevent_common_check_signal();
    (bso#11308).

  + Improve pytevent bindings.

  + Testsuite fixes.

  + Improve the documentation of the tevent_add_fd()     assumtions. it must be talloc_free'ed before closing the     fd! (bso##11141); (bso#11316).

  + Update to 0.9.24.

  + Ignore unexpected signal events in the same way the     epoll backend does.

  + Update to 0.9.23.

  + Update the tevent_data.dox tutrial stuff to fix some     errors, including white space problems.

  + Use tevent_req_simple_recv_unix in a few places.

  + Update to 0.9.22.

  + Remove unused exit_code in tevent_select.c

  + Remove unused exit_code in tevent_poll.c

  + Build: improve detection of srcdir

  + Lib: tevent: make tevent_sig_increment atomic.

  + Update flags in tevent pkgconfig file

  + Utilize doxygen to generate the api documentation and     package it.

This update for ldb, samba, talloc, tdb, tevent fixes the following security issues and bugs :

The Samba LDB was updated to version 1.1.24 :

  - Fix ldap \00 search expression attack dos;
    CVE-2015-3223; (bso#11325)

  - Fix remote read memory exploit in ldb; CVE-2015-5330;
    (bso#11599)

  - Move ldb_(un)pack_data into ldb_module.h for testing

  - Fix installation of _ldb_text.py

  - Fix propagation of ldb errors through tdb

  - Fix bug triggered by having an empty message in database     during search

Samba was updated to fix these issues :

  - Malicious request can cause Samba LDAP server to hang,     spinning using CPU; CVE-2015-3223; (bso#11325);
    (bnc#958581).

  - Remote read memory exploit in LDB; CVE-2015-5330;
    (bso#11599); (bnc#958586).

  - Insufficient symlink verification (file access outside     the share); CVE-2015-5252; (bso#11395); (bnc#958582).

  - No man in the middle protection when forcing smb     encryption on the client side; CVE-2015-5296;
    (bso#11536); (bnc#958584).

  - Currently the snapshot browsing is not secure thru     windows previous version (shadow_copy2); CVE-2015-5299;
    (bso#11529); (bnc#958583).

  - Fix Microsoft MS15-096 to prevent machine accounts from     being changed into user accounts; CVE-2015-8467;
    (bso#11552); (bnc#958585).

  - Changing log level of two entries to from 1 to 3;
    (bso#9912).

  - vfs_gpfs: Re-enable share modes; (bso#11243).

  - wafsamba: Also build libraries with RELRO protection;
    (bso#11346).

  - ctdb: Strip trailing spaces from nodes file;
    (bso#11365).

  - s3-smbd: Fix old DOS client doing wildcard delete -     gives a attribute type of zero; (bso#11452).

  - nss_wins: Do not run into use after free issues when we     access memory allocated on the globals and the global     being reinitialized; (bso#11563).

  - async_req: Fix non-blocking connect(); (bso#11564).

  - auth: gensec: Fix a memory leak; (bso#11565).

  - lib: util: Make non-critical message a warning;
    (bso#11566).

  - Fix winbindd crashes with samlogon for trusted domain     user; (bso#11569); (bnc#949022).

  - smbd: Send SMB2 oplock breaks unencrypted; (bso#11570).

  - ctdb: Open the RO tracking db with perms 0600 instead of     0000; (bso#11577).

  - manpage: Correct small typo error; (bso#11584).

  - s3: smbd: If EA's are turned off on a share don't allow     an SMB2 create containing them; (bso#11589).

  - Backport some valgrind fixes from upstream master;
    (bso#11597).

  - s3: smbd: have_file_open_below() fails to enumerate open     files below an open directory handle; (bso#11615).

  - docs: Fix some typos in the idmap config section of man     5 smb.conf; (bso#11619).

  - Cleanup and enhance the pidl sub package.

  - s3: smbd: Fix our access-based enumeration on 'hide     unreadable' to match Windows; (bso#10252).

  - smbd: Fix file name buflen and padding in notify     repsonse; (bso#10634).

  - kerberos: Make sure we only use prompter type when     available; (bso#11038).

  - s3:ctdbd_conn: Make sure we destroy tevent_fd before     closing the socket; (bso#11316).

  - dcerpc.idl: accept invalid dcerpc_bind_nak pdus;
    (bso#11327).

  - Fix a deadlock in tdb; (bso#11381).

  - s3: smbd: Fix mkdir race condition; (bso#11486).

  - pam_winbind: Fix a segfault if initialization fails;
    (bso#11502).

  - s3: dfs: Fix a crash when the dfs targets are disabled;
    (bso#11509).

  - s3: smbd: Fix opening/creating :stream files on the root     share directory; (bso#11522).

  - net: Fix a crash with 'net ads keytab create';
    (bso#11528).

  - s3: smbd: Fix a crash in unix_convert() and a NULL     pointer bug introduced by previous 'raw' stream fix     (bso#11522); (bso#11535).

  - vfs_fruit: Return value of ad_pack in vfs_fruit.c;
    (bso#11543).

  - vfs_commit: Set the fd on open before calling     SMB_VFS_FSTAT; (bso#11547).

  - Fix bug in smbstatus where the lease info is not     printed; (bso#11549).

  - s3:smbstatus: Add stream name to share_entry_forall();
    (bso#11550).

  - Prevent NULL pointer access in samlogon fallback when     security credentials are null; (bnc#949022).

  - Fix 100% CPU in winbindd when logging in with 'user must     change password on next logon'; (bso#11038).

talloc was updated to version 2.1.5; (bsc#954658) (bsc#951660).

  - Test that talloc magic differs between processes.

  - Increment minor version due to added     talloc_test_get_magic.

  - Provide tests access to talloc_magic.

  - Test magic protection measures.

tdb was updated to version 1.3.8; (bsc#954658).

  - Improved python3 bindings

tevent was updated to 0.9.26; (bsc#954658).

  - New tevent_thread_proxy api

  - Minor build fixes This update was imported from the     SUSE:SLE-12-SP1:Update update project.

This update for ldb, samba, talloc, tdb, tevent fixes the following security issues and bugs :

The Samba LDB was updated to version 1.1.24 :

  - Fix ldap \00 search expression attack dos;
    CVE-2015-3223; (bso#11325)

  - Fix remote read memory exploit in ldb; CVE-2015-5330;
    (bso#11599)

  - Move ldb_(un)pack_data into ldb_module.h for testing

  - Fix installation of _ldb_text.py

  - Fix propagation of ldb errors through tdb

  - Fix bug triggered by having an empty message in database     during search

Samba was updated to fix these issues :

  - Malicious request can cause Samba LDAP server to hang,     spinning using CPU; CVE-2015-3223; (bso#11325);
    (bnc#958581).

  - Remote read memory exploit in LDB; CVE-2015-5330;
    (bso#11599); (bnc#958586).

  - Insufficient symlink verification (file access outside     the share); CVE-2015-5252; (bso#11395); (bnc#958582).

  - No man in the middle protection when forcing smb     encryption on the client side; CVE-2015-5296;
    (bso#11536); (bnc#958584).

  - Currently the snapshot browsing is not secure thru     windows previous version (shadow_copy2); CVE-2015-5299;
    (bso#11529); (bnc#958583).

  - Fix Microsoft MS15-096 to prevent machine accounts from     being changed into user accounts; CVE-2015-8467;
    (bso#11552); (bnc#958585).

  - Changing log level of two entries to from 1 to 3;
    (bso#9912).

  - vfs_gpfs: Re-enable share modes; (bso#11243).

  - wafsamba: Also build libraries with RELRO protection;
    (bso#11346).

  - ctdb: Strip trailing spaces from nodes file;
    (bso#11365).

  - s3-smbd: Fix old DOS client doing wildcard delete -     gives a attribute type of zero; (bso#11452).

  - nss_wins: Do not run into use after free issues when we     access memory allocated on the globals and the global     being reinitialized; (bso#11563).

  - async_req: Fix non-blocking connect(); (bso#11564).

  - auth: gensec: Fix a memory leak; (bso#11565).

  - lib: util: Make non-critical message a warning;
    (bso#11566).

  - Fix winbindd crashes with samlogon for trusted domain     user; (bso#11569); (bnc#949022).

  - smbd: Send SMB2 oplock breaks unencrypted; (bso#11570).

  - ctdb: Open the RO tracking db with perms 0600 instead of     0000; (bso#11577).

  - manpage: Correct small typo error; (bso#11584).

  - s3: smbd: If EA's are turned off on a share don't allow     an SMB2 create containing them; (bso#11589).

  - Backport some valgrind fixes from upstream master;
    (bso#11597).

  - s3: smbd: have_file_open_below() fails to enumerate open     files below an open directory handle; (bso#11615).

  - docs: Fix some typos in the idmap config section of man     5 smb.conf; (bso#11619).

  - Cleanup and enhance the pidl sub package.

  - s3: smbd: Fix our access-based enumeration on 'hide     unreadable' to match Windows; (bso#10252).

  - smbd: Fix file name buflen and padding in notify     repsonse; (bso#10634).

  - kerberos: Make sure we only use prompter type when     available; (bso#11038).

  - s3:ctdbd_conn: Make sure we destroy tevent_fd before     closing the socket; (bso#11316).

  - dcerpc.idl: accept invalid dcerpc_bind_nak pdus;
    (bso#11327).

  - Fix a deadlock in tdb; (bso#11381).

  - s3: smbd: Fix mkdir race condition; (bso#11486).

  - pam_winbind: Fix a segfault if initialization fails;
    (bso#11502).

  - s3: dfs: Fix a crash when the dfs targets are disabled;
    (bso#11509).

  - s3: smbd: Fix opening/creating :stream files on the root     share directory; (bso#11522).

  - net: Fix a crash with 'net ads keytab create';
    (bso#11528).

  - s3: smbd: Fix a crash in unix_convert() and a NULL     pointer bug introduced by previous 'raw' stream fix     (bso#11522); (bso#11535).

  - vfs_fruit: Return value of ad_pack in vfs_fruit.c;
    (bso#11543).

  - vfs_commit: Set the fd on open before calling     SMB_VFS_FSTAT; (bso#11547).

  - Fix bug in smbstatus where the lease info is not     printed; (bso#11549).

  - s3:smbstatus: Add stream name to share_entry_forall();
    (bso#11550).

  - Prevent NULL pointer access in samlogon fallback when     security credentials are null; (bnc#949022).

  - Fix 100% CPU in winbindd when logging in with 'user must     change password on next logon'; (bso#11038).

talloc was updated to version 2.1.5; (bsc#954658) (bsc#951660).

  - Test that talloc magic differs between processes.

  - Increment minor version due to added     talloc_test_get_magic.

  - Provide tests access to talloc_magic.

  - Test magic protection measures.

tdb was updated to version 1.3.8; (bsc#954658).

  - Improved python3 bindings

tevent was updated to 0.9.26; (bsc#954658).

  - New tevent_thread_proxy api

  - Minor build fixes

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ldb, samba, talloc, tdb, tevent fixes the following security issues :

  - ldb was updated to version 1.1.24.

  + Fix ldap \00 search expression attack dos;
    CVE-2015-3223; (bso#11325)

  + Fix remote read memory exploit in ldb; CVE-2015-5330;
    (bso#11599)

  + Move ldb_(un)pack_data into ldb_module.h for testing

  + Fix installation of _ldb_text.py

  + Fix propagation of ldb errors through tdb

  + Fix bug triggered by having an empty message in database     during search

  - Move the ldb-cmdline library to the ldb-tools package as     the packaged binaries depend on it.

  - Update the samba library distribution key file     'ldb.keyring'; (bso#945116).

Samba was updated to fix these issues :

  - Malicious request can cause samba ldap server to hang,     spinning using cpu; CVE-2015-3223; (bso#11325);
    (bsc#958581).

  - Remote read memory exploit in ldb; cve-2015-5330;
    (bso#11599); (bsc#958586).

  - Insufficient symlink verification (file access outside     the share); CVE-2015-5252; (bso#11395); (bsc#958582).

  - No man in the middle protection when forcing smb     encryption on the client side; CVE-2015-5296;
    (bso#11536); (bsc#958584).

  - Currently the snapshot browsing is not secure thru     windows previous version (shadow_copy2); CVE-2015-5299;
    (bso#11529); (bsc#958583).

  - Fix microsoft ms15-096 to prevent machine accounts from     being changed into user accounts; CVE-2015-8467;
    (bso#11552); (bsc#958585).

  - Changing log level of two entries to from 1 to 3;
    (bso#9912).

  - Vfs_gpfs: re-enable share modes; (bso#11243).

  - Wafsamba: also build libraries with relro protection;
    (bso#11346).

  - Ctdb: strip trailing spaces from nodes file;
    (bso#11365).

  - S3-smbd: fix old dos client doing wildcard delete -     gives a attribute type of zero; (bso#11452).

  - Nss_wins: do not run into use after free issues when we     access memory allocated on the globals and the global     being reinitialized; (bso#11563).

  - Async_req: fix non-blocking connect(); (bso#11564).

  - Auth: gensec: fix a memory leak; (bso#11565).

  - Lib: util: make non-critical message a warning;
    (bso#11566).

  - Fix winbindd crashes with samlogon for trusted domain     user; (bso#11569); (bsc#949022).

  - Smbd: send smb2 oplock breaks unencrypted; (bso#11570).

  - Ctdb: open the ro tracking db with perms 0600 instead of     0000; (bso#11577).

  - Manpage: correct small typo error; (bso#11584).

  - S3: smbd: if ea's are turned off on a share don't allow     an smb2 create containing them; (bso#11589).

  - Backport some valgrind fixes from upstream master;
    (bso#11597).

  - S3: smbd: have_file_open_below() fails to enumerate open     files below an open directory handle; (bso#11615).

  - Docs: fix some typos in the idmap config section of man     5 smb.conf; (bso#11619).

  - Cleanup and enhance the pidl sub package.

  - S3: smbd: fix our access-based enumeration on 'hide     unreadable' to match Windows; (bso#10252).

  - Smbd: fix file name buflen and padding in notify     repsonse; (bso#10634).

  - Kerberos: make sure we only use prompter type when     available; (bso#11038).

  - S3:ctdbd_conn: make sure we destroy tevent_fd before     closing the socket; (bso#11316).

  - Dcerpc.idl: accept invalid dcerpc_bind_nak pdus;
    (bso#11327).

  - Fix a deadlock in tdb; (bso#11381).

  - S3: smbd: fix mkdir race condition; (bso#11486).

  - Pam_winbind: fix a segfault if initialization fails;
    (bso#11502).

  - S3: dfs: fix a crash when the dfs targets are disabled;
    (bso#11509).

  - S3: smbd: fix opening/creating :stream files on the root     share directory; (bso#11522).

  - Net: fix a crash with 'net ads keytab create';
    (bso#11528).

  - S3: smbd: fix a crash in unix_convert() and a NULL     pointer bug introduced by previous 'raw' stream fix     (bso#11522); (bso#11535).

  - Vfs_fruit: return value of ad_pack in vfs_fruit.c;
    (bso#11543).

  - Vfs_commit: set the fd on open before calling     smb_vfs_fstat; (bso#11547).

  - Fix bug in smbstatus where the lease info is not     printed; (bso#11549).

  - S3:smbstatus: add stream name to share_entry_forall();
    (bso#11550).

  - Prevent NULL pointer access in samlogon fallback when     security credentials are null; (bsc#949022).

  - Fix 100% cpu in winbindd when logging in with 'user must     change password on next logon'; (bso#11038).

talloc was updated to version 2.1.5; (bsc#954658) (bsc#951660).

  + Test that talloc magic differs between processes.

  + Increment minor version due to added     talloc_test_get_magic.

  + Provide tests access to talloc_magic.

  + Test magic protection measures.

tdb was updated to version 1.3.8; (bsc#954658).

  + First fix deadlock in the interaction between fcntl and     mutex locking; (bso#11381)

  + Improved python3 bindings

  + Fix runtime detection for robust mutexes in the     standalone build; (bso#11326).

  + Possible fix for the build with robust mutexes on     solaris 11; (bso#11319).

  + Abi change: tdb_chainlock_read_nonblock() has been     added, a nonblock variant of tdb_chainlock_read()

  + Do not build test binaries if it's not a standalone     build

  + Fix cid 1034842 resource leak

  + Fix cid 1034841 resource leak

  + Don't let tdb_wrap_open() segfault with name==null

  + Toos: allow transactions with tdb_mutex_locking

  + Test: add tdb1-run-mutex-transaction1 test

  + Allow transactions on on tdb's with tdb_mutex_locking

  + Test: tdb_clear_if_first | tdb_mutex_locking, o_rdonly     is a valid combination

  + Allow tdb_open_ex() with o_rdonly of     tdb_feature_flag_mutex tdbs.

  + Fix a comment

  + Fix tdb_runtime_check_for_robust_mutexes()

  + Improve wording in a comment

  + Tdb.h needs bool type; obsoletes     include_stdbool_bso10625.patch

  + Tdb_wrap: make mutexes easier to use

  + Tdb_wrap: only pull in samba-debug

  + Tdb_wrap: standalone compile without includes.h

  + Tdb_wrap: tdb_wrap.h doesn't need struct     loadparm_context

  - Update to version 1.3.1.

  + Tools: fix a compiler warning

  + Defragment the freelist in tdb_allocate_from_freelist()

  + Add 'freelist_size' sub-command to tdbtool

  + Use tdb_freelist_merge_adjacent in tdb_freelist_size()

  + Add tdb_freelist_merge_adjacent()

  + Add utility function check_merge_ptr_with_left_record()

  + Simplify tdb_free() using check_merge_with_left_record()

  + Add utility function check_merge_with_left_record()

  + Improve comments for tdb_free().

  + Factor merge_with_left_record() out of tdb_free()

  + Fix debug message in tdb_free()

  + Reduce indentation in tdb_free() for merging left

  + Increase readability of read_record_on_left()

  + Factor read_record_on_left() out of tdb_free()

  + Build: improve detection of srcdir.

tevent was updated to 0.9.26; (bsc#954658).

  + New tevent_thread_proxy api

  + Minor build fixes

  + Fix compile error in solaris ports backend.

  + Fix access after free in tevent_common_check_signal();
    (bso#11308).

  + Improve pytevent bindings.

  + Testsuite fixes.

  + Improve the documentation of the tevent_add_fd()     assumtions. it must be talloc_free'ed before closing the     fd! (bso##11141); (bso#11316).

  + Ignore unexpected signal events in the same way the     epoll backend does.

  + Update the tevent_data.dox tutrial stuff to fix some     errors, including white space problems.

  + Use tevent_req_simple_recv_unix in a few places.

  + Remove unused exit_code in tevent_select.c

  + Remove unused exit_code in tevent_poll.c

  + Build: improve detection of srcdir

  + Lib: tevent: make tevent_sig_increment atomic.

  + Update flags in tevent pkgconfig file

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samba team reports :

[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.

[CVE-2015-5330] Malicious request can cause Samba LDAP server to return uninitialized memory that should not be part of the reply.

[CVE-2015-5296] Requesting encryption should also request signing when setting up the connection to protect against man-in-the-middle attacks.

[CVE-2015-5299] A missing access control check in the VFS shadow_copy2 module could allow unauthorized users to access snapshots.

[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.

[CVE-2015-8467] Samba can expose Windows DCs to MS15-096 Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).

[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.

ID	Name	Product	Family	Severity
96127	GLSA-201612-47 : Samba: Multiple vulnerabilities (Badlock)	Nessus	Gentoo Local Security Checks	high
9346	Samba 4.x < 4.1.22 Multiple Vulnerabilities	Nessus Network Monitor	Samba	medium
90558	openSUSE Security Update : samba (openSUSE-2016-462) (Badlock)	Nessus	SuSE Local Security Checks	high
87769	Samba 4.2.x < 4.2.7 / 4.3.x < 4.3.3 Multiple Vulnerabilities	Nessus	Misc.	high
87768	Samba 4.x < 4.1.22 Multiple Vulnerabilities	Nessus	Misc.	high
87755	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2855-1)	Nessus	Ubuntu Local Security Checks	high
87684	Debian DSA-3433-1 : samba - security update	Nessus	Debian Local Security Checks	high
87622	openSUSE Security Update : samba / ldb / talloc / etc (openSUSE-2015-945)	Nessus	SuSE Local Security Checks	high
87621	openSUSE Security Update : ldb / samba / talloc / etc (openSUSE-2015-943)	Nessus	SuSE Local Security Checks	high
87527	SUSE SLED12 / SLES12 Security Update : ldb, samba, talloc, tdb, tevent (SUSE-SU-2015:2305-1)	Nessus	SuSE Local Security Checks	high
87526	SUSE SLED12 / SLES12 Security Update : ldb, samba, talloc, tdb, tevent (SUSE-SU-2015:2304-1)	Nessus	SuSE Local Security Checks	high
87514	FreeBSD : samba -- multiple vulnerabilities (ef434839-a6a4-11e5-8275-000c292e4fd8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-8467

high

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

high

high