Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3774
samba security update
10 November 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: samba
Publisher: Debian
Operating System: Debian GNU/Linux
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Increased Privileges -- Existing Account
Denial of Service -- Existing Account
Provide Misleading Information -- Existing Account
Reduced Security -- Remote/Unauthenticated
Unauthorised Access -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2021-23192 CVE-2021-3738 CVE-2020-25722
CVE-2020-25721 CVE-2020-25719 CVE-2020-25718
CVE-2020-25717 CVE-2016-2124
Original Bulletin:
https://lists.debian.org/debian-security-announce/2021/msg00188.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running samba check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-5003-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 09, 2021 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : samba
CVE ID : CVE-2016-2124 CVE-2020-25717 CVE-2020-25718 CVE-2020-25719
CVE-2020-25721 CVE-2020-25722 CVE-2021-3738 CVE-2021-23192
Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix.
CVE-2016-2124
Stefan Metzmacher reported that SMB1 client connections can be
downgraded to plaintext authentication.
CVE-2020-25717
Andrew Bartlett reported that Samba may map domain users to local
users in an undesired way, allowing for privilege escalation. The
update introduces a new parameter "min domain uid" (default to 1000)
to not accept a UNIX uid below this value.
CVE-2020-25718
Andrew Bartlett reported that Samba as AD DC, when joined by an
RODC, did not confirm if the RODC was allowed to print a ticket for
that user, allowing an RODC to print administrator tickets.
CVE-2020-25719
Andrew Bartlett reported that Samba as AD DC, did not always rely on
the SID and PAC in Kerberos tickets and could be confused about the
user a ticket represents. If a privileged account was attacked this
could lead to total domain compromise.
CVE-2020-25721
Andrew Bartlett reported that Samba as a AD DC did not provide a way
for Linux applications to obtain a reliable SID (and samAccountName)
in issued tickets.
CVE-2020-25722
Andrew Bartlett reported that Samba as AD DC did not do sufficient
access and conformance checking of data stored, potentially allowing
total domain compromise.
CVE-2021-3738
William Ross reported that the Samba AD DC RPC server can use memory
that was free'd when a sub-connection is closed, resulting in denial
of service, and potentially, escalation of privileges.
CVE-2021-23192
Stefan Metzmacher reported that if a client to a Samba server sent a
very large DCE/RPC request, and chose to fragment it, an attacker
could replace later fragments with their own data, bypassing the
signature requirements.
For the stable distribution (bullseye), these problems have been fixed in
version 2:4.13.13+dfsg-1~deb11u2.
We recommend that you upgrade your samba packages.
For the detailed security status of samba please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/samba
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmGKwX5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0R2eRAAk7NBLcriA0piVGV1+8+z2842CI5iGbl5eGQN4WynPM5KvKxxEIoXJ6Ez
VqKB5bz1lxMl6LenRAHej4XEXvT2HijAdhTHTOzXGfz72YeDO9a30O5H8pjIEG54
7Nkx+BRXcky53Gz94dxPIv0acyyYQs97lMGPreVzbTZnODv+5OQpkFGXCoYOsXFx
xwXLVagaOGu0GD82ZANnP7U9/+4EDlFQjYCwB2Abu6GuxT76WDLHthiJgA3IzWcm
CAscmokRIbA6D3tnbpGlorw8BS1UGdCERcC7lFxe+hl+MN6OkA5HmaKY8OdrRrwz
ONWGSm0yCVjlIUCAoyiyzPwYSmKp6/cF2PbZrhAaWlka/oOH7Ay9+LrQuV7/bu8C
BQnPxUtvOEXnpiOT/4C9MEHV1hxFmuk7AUAYx4RXBeqhrkLkh1rOzvunSyrcwJ+O
UlDhaxXCDe80nwl711HlJNJEt7Z2hxqM9M5ts94RBp3UPB5NQz1v7qQC+KnZfaRW
J3KUUsMRHF9nAlIPxUwKrTV1VLQc1rl7/RrTh0rAZbouoXvYlQpfmJ1lPI95t6KJ
cwJQ9TTQPaP7RQ8Bg3nYpJ+fCvzjeuk0rm4U+ZRb6cH41URlsFujg4X1AjCHLUUB
B6xlNyMHuDnLAW/YRnwhZnQYqg63HX0kmaUZtbN+172rzTHScuA=
=1OLX
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYYtH/ONLKJtyKPYoAQjnyQ/+J3ILoxy2QAQYXzcByyxWiioKt1TXTvKW
dPiFweNFA7sPW0ME6KerObpSMx5PwkYp+1nwinx+PhBSZiGgpRmZEx3ZUOQn4k4p
LvM2TZ2/M7IFH9kDYCkJys5ks9d3zlDzcHcraWVckOWH4kdmKZzT4gk5VQBHFi3B
uQzKpjP6a7VjoL/4K2+DOkM1e2JWUP6Yg4GXG7uv+4lX/tTk6D+Nd3PLlNOLedyd
lu9B5zD18sn/S+K8tU97WBVL4we4e/G9V18HkxMtpdJTdXIznZnhTyHd9sftRhNa
JPXOoeXh02SuGz5KZiKHTB5uA221mPsMOqIM/OxaD0fwP8glQpU5tPWDeJmp8bfp
gnAz+27VXMpgc3tpB6QBk9Jd8A7gGITLv+Wlh/M9PW6ML/wnCNkbRvBbEzJn82hL
LFLvGw3WfwmVannBaeydjVUK8w1iqiOU/5p0NlzqFA0rPdZWY4BKWy3VDbK+tCIw
cMQOeFFqjorZTAt6kDZtGh5/o02uT4VgnxlLGuarlId6LDWvHAfXJS9Au80OFPzW
8tOKNGX/tuDCaS/waXIavHi1EjxcWx+1fEuILgMG34Q5x14gh9cvsViYiN/dlML1
V9VN++F0ulH97p9GcwHVYrOWOqvOupY3fze2v3ulXRY4VP+Ow07v2z8oIPdC+3BY
bYPK8d3sJ4k=
=VLz9
-----END PGP SIGNATURE-----