A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability. (CVE-2020-10730)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability. (CVE-2020-10745)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba. (CVE-2020-10760)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash. (CVE-2020-14303)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'. (CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - As Samba internally opens an underlying file system     handle on a directory when a client requests an open,     even for FILE_READ_ATTRIBUTES then if the underlying     file system permissions don&#39t allow &quotr&quot     (read) access for the connected user, then the handle     open request will be denied.&quot(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Samba, all versions starting samba     4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2,     in the way it handles a user password change or a new     password for a samba user. The Samba Active Directory     Domain Controller can be configured to use a custom     script to check for password complexity. This     configuration can fail to verify password complexity     when non-ASCII characters are used in the password,     which could lead to weak passwords being set for samba     users, making it vulnerable to dictionary     attacks.(CVE-2019-14833)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and     samba 4.10.x before 4.10.10. An attacker can crash AD     DC LDAP server via dirsync resulting in denial of     service. Privilege escalation is not possible with this     issue.(CVE-2019-14847)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - Heimdal before 7.4 allows remote attackers to     impersonate services with Orpheus' Lyre attacks because     it obtains service-principal names in a way that     violates the Kerberos 5 protocol specification. In
    _krb5_extract_ticket() the KDC-REP service name must be     obtained from the encrypted version stored in     'enc_part' instead of the unencrypted version stored in     'ticket'. Use of the unencrypted version provides an     opportunity for successful server impersonation and     other attacks. NOTE: this CVE is only for Heimdal and     other products that embed Heimdal code it does not     apply to other instances in which this part of the     Kerberos 5 protocol specification is     violated.(CVE-2017-11103)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix.

CVE-2020-1472

Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations.

CVE-2020-10704

An unauthorized user can trigger a denial of service via a stack overflow in the AD DC LDAP server.

CVE-2020-10730

NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results.

CVE-2020-10745

Denial of service resulting from abuse of compression of replies to NetBIOS over TCP/IP name resolution and DNS packets causing excessive CPU load on the Samba AD DC.

CVE-2020-10760

The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free.

CVE-2020-14303

Denial of service resulting from CPU spin and and inability to process further requests once the AD DC NBT server receives an empty (zero-length) UDP packet to port 137.

CVE-2020-14318

Missing handle permissions check in ChangeNotify

CVE-2020-14323

Unprivileged user can crash winbind via invalid lookupsids DoS

CVE-2020-14383

DNS server crash via invalid records resulting from uninitialized variables

For Debian 9 stretch, these problems have been fixed in version 2:4.5.16+dfsg-1+deb9u3.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to its security tracker page at: https://security-tracker.debian.org/tracker/samba

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heimdal before 7.4 allows remote attackers to     impersonate services with Orpheus' Lyre attacks because     it obtains service-principal names in a way that     violates the Kerberos 5 protocol specification. In
    _krb5_extract_ticket() the KDC-REP service name must be     obtained from the encrypted version stored in     'enc_part' instead of the unencrypted version stored in     'ticket'. Use of the unencrypted version provides an     opportunity for successful server impersonation and     other attacks. NOTE: this CVE is only for Heimdal and     other products that embed Heimdal code it does not     apply to other instances in which this part of the     Kerberos 5 protocol specification is     violated.(CVE-2017-11103)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - There is an issue in all samba 4.11.x versions before     4.11.5, all samba 4.10.x versions before 4.10.12 and     all samba 4.9.x versions before 4.9.18, where the     removal of the right to create or modify a subtree     would not automatically be taken away on all domain     controllers.(CVE-2019-14902)

  - All samba versions 4.9.x before 4.9.18, 4.10.x before     4.10.12 and 4.11.x before 4.11.5 have an issue where if     it is set with 'log level = 3' (or above) then the     string obtained from the client, after a failed     character conversion, is printed. Such strings can be     provided during the NTLMSSP authentication exchange. In     the Samba AD DC in particular, this may cause a     long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely     target, smbd, operates as process-per-client and so a     crash there is harmless).(CVE-2019-14907)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the (poorly named) dnsserver RPC pipe provides     administrative facilities to modify DNS records and     zones. Samba, when acting as an AD DC, stores DNS     records in LDAP. In AD, the default permissions on the     DNS partition allow creation of new records by     authenticated users. This is used for example to allow     machines to self-register in DNS. If a DNS record was     created that case-insensitively matched the name of the     zone, the ldb_qsort() and dns_name_compare() routines     could be confused into reading memory prior to the list     of DNS entries when responding to DnssrvEnumRecords()     or DnssrvEnumRecords2() and so following invalid memory     as a pointer.(CVE-2019-14861)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the S4U (MS-SFU) Kerberos delegation model includes a     feature allowing for a subset of clients to be opted     out of constrained delegation in any way, either     S4U2Self or regular Kerberos authentication, by forcing     all tickets for these clients to be non-forwardable. In     AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which     translates to disallow-forwardable. However the Samba     AD DC does not do that for S4U2Self and does set the     forwardable flag even if the impersonated client has     the not-delegated flag set.(CVE-2019-14870)

  - A flaw was found in the samba client, all samba     versions before samba 4.11.2, 4.10.10 and 4.9.15, where     a malicious server can supply a pathname to the client     with separators. This could allow the client to access     files and folders outside of the SMB network pathnames.
    An attacker could use this vulnerability to create     files outside of the current working directory using     the privileges of the client user.(CVE-2019-10218)

  - A flaw was found in Samba, all versions starting samba     4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2,     in the way it handles a user password change or a new     password for a samba user. The Samba Active Directory     Domain Controller can be configured to use a custom     script to check for password complexity. This     configuration can fail to verify password complexity     when non-ASCII characters are used in the password,     which could lead to weak passwords being set for samba     users, making it vulnerable to dictionary     attacks.(CVE-2019-14833)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and     samba 4.10.x before 4.10.10. An attacker can crash AD     DC LDAP server via dirsync resulting in denial of     service. Privilege escalation is not possible with this     issue.(CVE-2019-14847)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

  - A flaw was found in samba's Heimdal KDC implementation,     versions 4.8.x up to, excluding 4.8.12, 4.9.x up to,     excluding 4.9.8 and 4.10.x up to, excluding 4.10.3,     when used in AD DC mode. A man in the middle attacker     could use this flaw to intercept the request to the KDC     and replace the user name (principal) in the request     with any desired user name (principal) that exists in     the KDC effectively obtaining a ticket for that     principal.(CVE-2018-16860)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The samba-libs package contains the libraries needed by     programs that link against the SMB, RPC and other     protocols provided by the Samba suite. Security     Fix(es):A flaw was found in samba's Heimdal KDC     implementation, versions 4.8.x up to, excluding 4.8.12,     4.9.x up to, excluding 4.9.8 and 4.10.x up to,     excluding 4.10.3, when used in AD DC mode. A man in the     middle attacker could use this flaw to intercept the     request to the KDC and replace the user name     (principal) in the request with any desired user name     (principal) that exists in the KDC effectively     obtaining a ticket for that principal.(CVE-2018-16860)A     flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)A NULL     pointer dereference, or possible use-after-free flaw     was found in the Samba AD LDAP server. Although some     versions of Samba shipped with Red Hat Enterprise Linux     do not support Samba in AD mode, the affected code is     shipped with the libldb package. This flaw allows an     authenticated user to possibly trigger a use-after-free     or NULL pointer dereference. The highest threat from     this vulnerability is to system     availability.(CVE-2020-10730)A flaw was found in Samba     in the way it processed NetBios over TCP/IP. This flaw     allows a remote attacker could to cause the Samba     server to consume excessive CPU use, resulting in a     denial of service. This highest threat from this     vulnerability is to system     availability.(CVE-2020-10745)A use-after-free flaw was     found in all samba LDAP server versions before 4.10.17,     before 4.11.11, before 4.12.4 used in a AC DC     configuration. A Samba LDAP user could use this flaw to     crash samba.(CVE-2020-10760)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ldb, samba fixes the following issues :

Changes in samba :

  - Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

  - Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

  - Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existent paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

  - Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

  - Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

  - Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

  - Add libnetapi-devel to baselibs conf, for wine usage;
    (bsc#1172307);

  - Installing: samba - samba-ad-dc.service does not exist     and unit not found; (bsc#1171437);

  - Fix samba_winbind package is installing python3-base     without python3 package; (bsc#1169521);

Changes in ldb :

  - Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

  - Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-202007-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for ldb, samba fixes the following issues :

Changes in samba: Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existant paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);

Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);

Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);

Changes in ldb: Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

  - CVE-2020-10745: Fixed an issue which parsing and packing     of NBT and DNS packets containing dots could potentially     have consumed excessive CPU (bsc#1173160).

  - CVE-2020-14303: Fixed an endless loop when receiving at     AD DC empty UDP packets (bsc#1173359).

  - CVE-2020-10730: Fixed a null de-reference in AD DC LDAP     server when ASQ and VLV combined (bsc#1173159).

  - CVE-2020-10760: Fixed a use-after-free in AD DC Global     Catalog LDAP server with paged_result or VLV     (bsc#1173161).

  - Added libnetapi-devel to baselibs conf, for wine usage     (bsc#1172307).

  - Fixed an installing issue where samba -     samba-ad-dc.service did not exist and unit was not found     (bsc#1171437).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Update to Samba 4.11.11

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

CVE-2020-10745: Fixed an issue which parsing and packing of NBT and DNS packets containing dots could potentially have consumed excessive CPU (bsc#1173160).

CVE-2020-14303: Fixed an endless loop when receiving at AD DC empty UDP packets (bsc#1173359).

CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).

CVE-2020-10760: Fixed a use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV (bsc#1173161).

Added libnetapi-devel to baselibs conf, for wine usage (bsc#1172307).

Fixed an installing issue where samba - samba-ad-dc.service did not exist and unit was not found (bsc#1171437).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 4.x prior to 4.10.17, 4.11.x prior to 4.11.11, or 4.12.x prior to 4.12.4.  It is, therefore, affected by multiple vulnerabilities, including the following:

  - The AD DC NBT server in Samba 4.0 will enter a CPU spin and not process further requests once it receives     an empty (zero-length) UDP packet to port 137. (CVE-2020-14303)

  - Compression of replies to NetBIOS over TCP/IP name resolution and DNS packets (which can be supplied as     UDP requests) can be abused to consume excessive amounts of CPU on the Samba AD DC (only).
    (CVE-2020-10745)

  - The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will     cause a use-after-free. (CVE-2020-10760)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4409-1 advisory.

    Andrew Bartlett discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could     use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10730)

    Douglas Bagnall discovered that Samba incorrectly handled certain queries. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2020-10745)

    Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use     this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 18.04 LTS, Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-10760)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Samba Team reports :

Four vulnerabilities were fixed in samba :

- CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results

- CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU in the AD DC (only)

- CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV

- CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd

Update to Samba 4.12.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151396	EulerOS Virtualization 3.0.2.2 : samba (EulerOS-SA-2021-2168)	Nessus	Huawei Local Security Checks	medium
147497	EulerOS Virtualization 2.9.1 : samba (EulerOS-SA-2021-1625)	Nessus	Huawei Local Security Checks	medium
147047	EulerOS Virtualization for ARM 64 3.0.6.0 : samba (EulerOS-SA-2021-1533)	Nessus	Huawei Local Security Checks	medium
146748	EulerOS 2.0 SP2 : samba (EulerOS-SA-2021-1357)	Nessus	Huawei Local Security Checks	high
144176	EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-2533)	Nessus	Huawei Local Security Checks	medium
143186	Debian DLA-2463-1 : samba security update	Nessus	Debian Local Security Checks	medium
142530	EulerOS Virtualization 3.0.6.6 : samba (EulerOS-SA-2020-2476)	Nessus	Huawei Local Security Checks	high
142101	EulerOS 2.0 SP5 : samba (EulerOS-SA-2020-2270)	Nessus	Huawei Local Security Checks	high
140877	EulerOS 2.0 SP3 : samba (EulerOS-SA-2020-2110)	Nessus	Huawei Local Security Checks	high
140322	EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2020-1952)	Nessus	Huawei Local Security Checks	high
140174	openSUSE Security Update : ldb / samba (openSUSE-2020-1313)	Nessus	SuSE Local Security Checks	high
138938	GLSA-202007-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
138790	openSUSE Security Update : ldb / samba (openSUSE-2020-1023)	Nessus	SuSE Local Security Checks	high
138760	SUSE SLED15 / SLES15 Security Update : ldb, samba (SUSE-SU-2020:1948-1)	Nessus	SuSE Local Security Checks	high
138748	openSUSE Security Update : samba (openSUSE-2020-984)	Nessus	SuSE Local Security Checks	high
138654	Fedora 31 : 2:samba / libldb (2020-5131d30947)	Nessus	Fedora Local Security Checks	high
138496	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:1913-1)	Nessus	SuSE Local Security Checks	high
138223	Samba 4.x < 4.10.17 / 4.11.x < 4.11.11 / 4.12.x < 4.12.4 Multiple Vulnerabilities	Nessus	Misc.	high
138134	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba vulnerabilities (USN-4409-1)	Nessus	Ubuntu Local Security Checks	high
138128	FreeBSD : samba -- Multiple Vulnerabilities (ae599263-bca2-11ea-b78f-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	high
138118	Fedora 32 : 2:samba / libldb (2020-ccd9bdb2eb)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-10760

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high