A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability. (CVE-2020-10730)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability. (CVE-2020-10745)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba. (CVE-2020-10760)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash. (CVE-2020-14303)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'. (CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2020:14437-1 advisory.

  - A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability     is to system availability. (CVE-2020-10745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - As Samba internally opens an underlying file system     handle on a directory when a client requests an open,     even for FILE_READ_ATTRIBUTES then if the underlying     file system permissions don&#39t allow &quotr&quot     (read) access for the connected user, then the handle     open request will be denied.&quot(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix.

CVE-2020-1472

Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations.

CVE-2020-10704

An unauthorized user can trigger a denial of service via a stack overflow in the AD DC LDAP server.

CVE-2020-10730

NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results.

CVE-2020-10745

Denial of service resulting from abuse of compression of replies to NetBIOS over TCP/IP name resolution and DNS packets causing excessive CPU load on the Samba AD DC.

CVE-2020-10760

The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free.

CVE-2020-14303

Denial of service resulting from CPU spin and and inability to process further requests once the AD DC NBT server receives an empty (zero-length) UDP packet to port 137.

CVE-2020-14318

Missing handle permissions check in ChangeNotify

CVE-2020-14323

Unprivileged user can crash winbind via invalid lookupsids DoS

CVE-2020-14383

DNS server crash via invalid records resulting from uninitialized variables

For Debian 9 stretch, these problems have been fixed in version 2:4.5.16+dfsg-1+deb9u3.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to its security tracker page at: https://security-tracker.debian.org/tracker/samba

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The samba-libs package contains the libraries needed by     programs that link against the SMB, RPC and other     protocols provided by the Samba suite. Security     Fix(es):A flaw was found in samba's Heimdal KDC     implementation, versions 4.8.x up to, excluding 4.8.12,     4.9.x up to, excluding 4.9.8 and 4.10.x up to,     excluding 4.10.3, when used in AD DC mode. A man in the     middle attacker could use this flaw to intercept the     request to the KDC and replace the user name     (principal) in the request with any desired user name     (principal) that exists in the KDC effectively     obtaining a ticket for that principal.(CVE-2018-16860)A     flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)A NULL     pointer dereference, or possible use-after-free flaw     was found in the Samba AD LDAP server. Although some     versions of Samba shipped with Red Hat Enterprise Linux     do not support Samba in AD mode, the affected code is     shipped with the libldb package. This flaw allows an     authenticated user to possibly trigger a use-after-free     or NULL pointer dereference. The highest threat from     this vulnerability is to system     availability.(CVE-2020-10730)A flaw was found in Samba     in the way it processed NetBios over TCP/IP. This flaw     allows a remote attacker could to cause the Samba     server to consume excessive CPU use, resulting in a     denial of service. This highest threat from this     vulnerability is to system     availability.(CVE-2020-10745)A use-after-free flaw was     found in all samba LDAP server versions before 4.10.17,     before 4.11.11, before 4.12.4 used in a AC DC     configuration. A Samba LDAP user could use this flaw to     crash samba.(CVE-2020-10760)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ldb, samba fixes the following issues :

Changes in samba :

  - Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

  - Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

  - Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existent paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

  - Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

  - Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

  - Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

  - Add libnetapi-devel to baselibs conf, for wine usage;
    (bsc#1172307);

  - Installing: samba - samba-ad-dc.service does not exist     and unit not found; (bsc#1171437);

  - Fix samba_winbind package is installing python3-base     without python3 package; (bsc#1169521);

Changes in ldb :

  - Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

  - Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

This update was imported from the SUSE:SLE-15-SP2:Update update project.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).

Fixed a packaging issue where samba_winbind package was installing python3-base without python3 (bsc#1169521).

Fixed an issue with spnego fallback from kerberos to ntlmssp in smbd server (bsc#1169473).

Fixed ntlm authentications with 'winbind use default domain = yes' (bsc#1173429).

Added solution for upgrade problem with libsmbldap2 package (bsc#1172810).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for ldb, samba fixes the following issues :

Changes in samba: Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existant paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);

Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);

Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);

Changes in ldb: Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

  - CVE-2020-10745: Fixed an issue which parsing and packing     of NBT and DNS packets containing dots could potentially     have consumed excessive CPU (bsc#1173160).

  - CVE-2020-14303: Fixed an endless loop when receiving at     AD DC empty UDP packets (bsc#1173359).

  - CVE-2020-10730: Fixed a null de-reference in AD DC LDAP     server when ASQ and VLV combined (bsc#1173159).

  - CVE-2020-10760: Fixed a use-after-free in AD DC Global     Catalog LDAP server with paged_result or VLV     (bsc#1173161).

  - Added libnetapi-devel to baselibs conf, for wine usage     (bsc#1172307).

  - Fixed an installing issue where samba -     samba-ad-dc.service did not exist and unit was not found     (bsc#1171437).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Update to Samba 4.11.11

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).

CVE-2020-14303: Fixed an endless loop when receiving at AD DC empty UDP packets (bsc#1173359).

CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).

CVE-2020-10760: Fixed a use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV (bsc#1173161).

Added libnetapi-devel to baselibs conf, for wine usage (bsc#1172307).

Fixed an installing issue where samba - samba-ad-dc.service did not exist and unit was not found (bsc#1171437).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 4.x prior to 4.10.17, 4.11.x prior to 4.11.11, or 4.12.x prior to 4.12.4.  It is, therefore, affected by multiple vulnerabilities, including the following:

  - The AD DC NBT server in Samba 4.0 will enter a CPU spin and not process further requests once it receives     an empty (zero-length) UDP packet to port 137. (CVE-2020-14303)

  - Compression of replies to NetBIOS over TCP/IP name resolution and DNS packets (which can be supplied as     UDP requests) can be abused to consume excessive amounts of CPU on the Samba AD DC (only).
    (CVE-2020-10745)

  - The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will     cause a use-after-free. (CVE-2020-10760)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4409-1 advisory.

    Andrew Bartlett discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could     use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10730)

    Douglas Bagnall discovered that Samba incorrectly handled certain queries. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2020-10745)

    Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use     this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 18.04 LTS, Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10760)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Samba Team reports :

Four vulnerabilities were fixed in samba :

- CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results

- CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU in the AD DC (only)

- CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV

- CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd

Update to Samba 4.12.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151396	EulerOS Virtualization 3.0.2.2 : samba (EulerOS-SA-2021-2168)	Nessus	Huawei Local Security Checks	medium
150607	SUSE SLES11 Security Update : samba (SUSE-SU-2020:14437-1)	Nessus	SuSE Local Security Checks	high
147497	EulerOS Virtualization 2.9.1 : samba (EulerOS-SA-2021-1625)	Nessus	Huawei Local Security Checks	medium
143186	Debian DLA-2463-1 : samba security update	Nessus	Debian Local Security Checks	medium
142530	EulerOS Virtualization 3.0.6.6 : samba (EulerOS-SA-2020-2476)	Nessus	Huawei Local Security Checks	high
142101	EulerOS 2.0 SP5 : samba (EulerOS-SA-2020-2270)	Nessus	Huawei Local Security Checks	high
140322	EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2020-1952)	Nessus	Huawei Local Security Checks	high
140174	openSUSE Security Update : ldb / samba (openSUSE-2020-1313)	Nessus	SuSE Local Security Checks	high
140001	EulerOS Virtualization for ARM 64 3.0.6.0 : samba (EulerOS-SA-2020-1898)	Nessus	Huawei Local Security Checks	high
139845	SUSE SLES12 Security Update : samba (SUSE-SU-2020:2312-1)	Nessus	SuSE Local Security Checks	high
139170	SUSE SLES12 Security Update : samba (SUSE-SU-2020:2066-1)	Nessus	SuSE Local Security Checks	high
139169	SUSE SLES15 Security Update : samba (SUSE-SU-2020:2065-1)	Nessus	SuSE Local Security Checks	high
139156	EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1826)	Nessus	Huawei Local Security Checks	high
138994	SUSE SLES12 Security Update : samba (SUSE-SU-2020:2036-1)	Nessus	SuSE Local Security Checks	high
138938	GLSA-202007-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
138790	openSUSE Security Update : ldb / samba (openSUSE-2020-1023)	Nessus	SuSE Local Security Checks	high
138760	SUSE SLED15 / SLES15 Security Update : ldb, samba (SUSE-SU-2020:1948-1)	Nessus	SuSE Local Security Checks	high
138748	openSUSE Security Update : samba (openSUSE-2020-984)	Nessus	SuSE Local Security Checks	high
138654	Fedora 31 : 2:samba / libldb (2020-5131d30947)	Nessus	Fedora Local Security Checks	high
138496	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:1913-1)	Nessus	SuSE Local Security Checks	high
138223	Samba 4.x < 4.10.17 / 4.11.x < 4.11.11 / 4.12.x < 4.12.4 Multiple Vulnerabilities	Nessus	Misc.	high
138134	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba vulnerabilities (USN-4409-1)	Nessus	Ubuntu Local Security Checks	high
138128	FreeBSD : samba -- Multiple Vulnerabilities (ae599263-bca2-11ea-b78f-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	high
138118	Fedora 32 : 2:samba / libldb (2020-ccd9bdb2eb)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-10745

high

Tenable Plugins

medium

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high