[IT-SecNots] [SECURITY] [DSA 5003-1] samba security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5003-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
November 09, 2021                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : samba
CVE ID         : CVE-2016-2124 CVE-2020-25717 CVE-2020-25718 CVE-2020-25719 
                 CVE-2020-25721 CVE-2020-25722 CVE-2021-3738 CVE-2021-23192

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix.

CVE-2016-2124

    Stefan Metzmacher reported that SMB1 client connections can be
    downgraded to plaintext authentication.

CVE-2020-25717

    Andrew Bartlett reported that Samba may map domain users to local
    users in an undesired way, allowing for privilege escalation. The
    update introduces a new parameter "min domain uid" (default to 1000)
    to not accept a UNIX uid below this value.

CVE-2020-25718

    Andrew Bartlett reported that Samba as AD DC, when joined by an
    RODC, did not confirm if the RODC was allowed to print a ticket for
    that user, allowing an RODC to print administrator tickets.

CVE-2020-25719

    Andrew Bartlett reported that Samba as AD DC, did not always rely on
    the SID and PAC in Kerberos tickets and could be confused about the
    user a ticket represents. If a privileged account was attacked this
    could lead to total domain compromise.

CVE-2020-25721

    Andrew Bartlett reported that Samba as a AD DC did not provide a way
    for Linux applications to obtain a reliable SID (and samAccountName)
    in issued tickets.

CVE-2020-25722

    Andrew Bartlett reported that Samba as AD DC did not do sufficient
    access and conformance checking of data stored, potentially allowing
    total domain compromise.

CVE-2021-3738

    William Ross reported that the Samba AD DC RPC server can use memory
    that was free'd when a sub-connection is closed, resulting in denial
    of service, and potentially, escalation of privileges.

CVE-2021-23192

    Stefan Metzmacher reported that if a client to a Samba server sent a
    very large DCE/RPC request, and chose to fragment it, an attacker
    could replace later fragments with their own data, bypassing the
    signature requirements.

For the stable distribution (bullseye), these problems have been fixed in
version 2:4.13.13+dfsg-1~deb11u2.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/samba

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmGKwX5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0R2eRAAk7NBLcriA0piVGV1+8+z2842CI5iGbl5eGQN4WynPM5KvKxxEIoXJ6Ez
VqKB5bz1lxMl6LenRAHej4XEXvT2HijAdhTHTOzXGfz72YeDO9a30O5H8pjIEG54
7Nkx+BRXcky53Gz94dxPIv0acyyYQs97lMGPreVzbTZnODv+5OQpkFGXCoYOsXFx
xwXLVagaOGu0GD82ZANnP7U9/+4EDlFQjYCwB2Abu6GuxT76WDLHthiJgA3IzWcm
CAscmokRIbA6D3tnbpGlorw8BS1UGdCERcC7lFxe+hl+MN6OkA5HmaKY8OdrRrwz
ONWGSm0yCVjlIUCAoyiyzPwYSmKp6/cF2PbZrhAaWlka/oOH7Ay9+LrQuV7/bu8C
BQnPxUtvOEXnpiOT/4C9MEHV1hxFmuk7AUAYx4RXBeqhrkLkh1rOzvunSyrcwJ+O
UlDhaxXCDe80nwl711HlJNJEt7Z2hxqM9M5ts94RBp3UPB5NQz1v7qQC+KnZfaRW
J3KUUsMRHF9nAlIPxUwKrTV1VLQc1rl7/RrTh0rAZbouoXvYlQpfmJ1lPI95t6KJ
cwJQ9TTQPaP7RQ8Bg3nYpJ+fCvzjeuk0rm4U+ZRb6cH41URlsFujg4X1AjCHLUUB
B6xlNyMHuDnLAW/YRnwhZnQYqg63HX0kmaUZtbN+172rzTHScuA=
=1OLX
-----END PGP SIGNATURE-----