A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.

This update for ldb, samba fixes the following issues :

Changes in samba :

  - Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

  - Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

  - Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existent paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

  - Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

  - Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

  - Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

  - Add libnetapi-devel to baselibs conf, for wine usage;
    (bsc#1172307);

  - Installing: samba - samba-ad-dc.service does not exist     and unit not found; (bsc#1171437);

  - Fix samba_winbind package is installing python3-base     without python3 package; (bsc#1169521);

Changes in ldb :

  - Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

  - Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-202007-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for ldb, samba fixes the following issues :

Changes in samba: Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existant paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);

Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);

Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);

Changes in ldb: Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the S4U (MS-SFU) Kerberos delegation model includes a     feature allowing for a subset of clients to be opted     out of constrained delegation in any way, either     S4U2Self or regular Kerberos authentication, by forcing     all tickets for these clients to be non-forwardable. In     AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which     translates to disallow-forwardable. However the Samba     AD DC does not do that for S4U2Self and does set the     forwardable flag even if the impersonated client has     the not-delegated flag set.(CVE-2019-14870)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the (poorly named) dnsserver RPC pipe provides     administrative facilities to modify DNS records and     zones. Samba, when acting as an AD DC, stores DNS     records in LDAP. In AD, the default permissions on the     DNS partition allow creation of new records by     authenticated users. This is used for example to allow     machines to self-register in DNS. If a DNS record was     created that case-insensitively matched the name of the     zone, the ldb_qsort() and dns_name_compare() routines     could be confused into reading memory prior to the list     of DNS entries when responding to DnssrvEnumRecords()     or DnssrvEnumRecords2() and so following invalid memory     as a pointer.(CVE-2019-14861)

  - All samba versions 4.9.x before 4.9.18, 4.10.x before     4.10.12 and 4.11.x before 4.11.5 have an issue where if     it is set with 'log level = 3' (or above) then the     string obtained from the client, after a failed     character conversion, is printed. Such strings can be     provided during the NTLMSSP authentication exchange. In     the Samba AD DC in particular, this may cause a     long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely     target, smbd, operates as process-per-client and so a     crash there is harmless).(CVE-2019-14907)

  - There is an issue in all samba 4.11.x versions before     4.11.5, all samba 4.10.x versions before 4.10.12 and     all samba 4.9.x versions before 4.9.18, where the     removal of the right to create or modify a subtree     would not automatically be taken away on all domain     controllers.(CVE-2019-14902)

  - A flaw was found in samba's Heimdal KDC implementation,     versions 4.8.x up to, excluding 4.8.12, 4.9.x up to,     excluding 4.9.8 and 4.10.x up to, excluding 4.10.3,     when used in AD DC mode. A man in the middle attacker     could use this flaw to intercept the request to the KDC     and replace the user name (principal) in the request     with any desired user name (principal) that exists in     the KDC effectively obtaining a ticket for that     principal.(CVE-2018-16860)

  - A use-after-free flaw was found in the way samba AD DC     LDAP servers, handled 'Paged Results' control is     combined with the 'ASQ' control. A malicious user in a     samba AD could use this flaw to cause denial of     service. This issue affects all samba versions before     4.10.15, before 4.11.8 and before     4.12.2.(CVE-2020-10700)

  - A use-after-free flaw was found in the way samba AD DC     LDAP servers, handled 'Paged Results' control is     combined with the 'ASQ' control. A malicious user in a     samba AD could use this flaw to cause denial of     service. This issue affects all samba versions before     4.10.15, before 4.11.8 and before     4.12.2.(CVE-2020-10700)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.10.15

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.11.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 4.10.x prior to 4.10.15, 4.11.x prior to 4.11.8, or 4.12.x prior to 4.12.2.  It is, therefore, affected by the following vulnerabilities :

  - A flaw exists related to handling 'ASQ' and 'Paged     Results' LDAP controls that could allow use-after-free     conditions having unspecified impact. (CVE-2020-10700)

  - A flaw exists related to handling deeply nested     filters, un-authenticated LDAP searches, and stack     memory that could allow  application crashes.
    (CVE-2020-10704)

Note that Nessus has not tested for these  issues but has instead relied only on the application's self-reported version number.

The Samba Team reports :

CVE-2020-10700

A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server.

CVE-2020-10704

A deeply nested filter in an un-authenticated LDAP search can exhaust the LDAP server's stack memory causing a SIGSEGV.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4341-1 advisory.

    Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use     this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10700)

    It was discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could possibly     use this issue to cause Samba to consume resources, resulting in a denial of service. (CVE-2020-10704)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
140174	openSUSE Security Update : ldb / samba (openSUSE-2020-1313)	Nessus	SuSE Local Security Checks	high
138938	GLSA-202007-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
138790	openSUSE Security Update : ldb / samba (openSUSE-2020-1023)	Nessus	SuSE Local Security Checks	high
138760	SUSE SLED15 / SLES15 Security Update : ldb, samba (SUSE-SU-2020:1948-1)	Nessus	SuSE Local Security Checks	high
137965	EulerOS Virtualization 3.0.6.0 : samba (EulerOS-SA-2020-1746)	Nessus	Huawei Local Security Checks	high
136383	Fedora 30 : 2:samba / libldb (2020-e244c98af5)	Nessus	Fedora Local Security Checks	high
136382	Fedora 31 : 2:samba / libldb (2020-9cf0b1c8f1)	Nessus	Fedora Local Security Checks	high
136177	Samba 4.10.x < 4.10.15 / 4.11.x < 4.11.8 / 4.12.x < 4.12.2 Multiple Vulnerabilities	Nessus	Misc.	high
136158	FreeBSD : samba -- multiple vulnerabilities (3c7911c9-8a29-11ea-8d8c-005056a311d1)	Nessus	FreeBSD Local Security Checks	high
136084	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba vulnerabilities (USN-4341-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2020-10700

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high