A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Samba from version 4.9.0 and before version 4.9.3 that     have AD DC configurations watching for bad passwords     (to restrict brute forcing of passwords) in a window of     more than 3 minutes may not watch for bad passwords at     all. The primary risk from this issue is with regards     to domains that have been upgraded from Samba 4.8 and     earlier. In these cases the manual testing done to     confirm an organisation's password policies apply as     expected may not have been re-done after the     upgrade.(CVE-2018-16857)

  - Samba from version 4.9.0 and before version 4.9.3 is     vulnerable to a NULL pointer de-reference. During the     processing of an DNS zone in the DNS management DCE/RPC     server, the internal DNS server or the Samba DLZ plugin     for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS     property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property     is set, the server will follow a NULL pointer and     terminate. There is no further vulnerability associated     with this issue, merely a denial of     service.(CVE-2018-16852)

  - A flaw was found in samba versions 4.9.x up to 4.9.13,     samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the     samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and     access the contents of directories outside the     share.(CVE-2019-10197)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and     samba 4.10.x before 4.10.10. An attacker can crash AD     DC LDAP server via dirsync resulting in denial of     service. Privilege escalation is not possible with this     issue.(CVE-2019-14847)

  - A flaw was found in Samba, all versions starting samba     4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2,     in the way it handles a user password change or a new     password for a samba user. The Samba Active Directory     Domain Controller can be configured to use a custom     script to check for password complexity. This     configuration can fail to verify password complexity     when non-ASCII characters are used in the password,     which could lead to weak passwords being set for samba     users, making it vulnerable to dictionary     attacks.(CVE-2019-14833)

  - A flaw was found in the samba client, all samba     versions before samba 4.11.2, 4.10.10 and 4.9.15, where     a malicious server can supply a pathname to the client     with separators. This could allow the client to access     files and folders outside of the SMB network pathnames.
    An attacker could use this vulnerability to create     files outside of the current working directory using     the privileges of the client user.(CVE-2019-10218)

  - A flaw was found in the way an LDAP search expression     could crash the shared LDAP server process of a samba     AD DC in samba before version 4.10. An authenticated     user, having read permissions on the LDAP server, could     use this flaw to cause denial of     service.(CVE-2019-3824)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the S4U (MS-SFU) Kerberos delegation model includes a     feature allowing for a subset of clients to be opted     out of constrained delegation in any way, either     S4U2Self or regular Kerberos authentication, by forcing     all tickets for these clients to be non-forwardable. In     AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which     translates to disallow-forwardable. However the Samba     AD DC does not do that for S4U2Self and does set the     forwardable flag even if the impersonated client has     the not-delegated flag set.(CVE-2019-14870)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the (poorly named) dnsserver RPC pipe provides     administrative facilities to modify DNS records and     zones. Samba, when acting as an AD DC, stores DNS     records in LDAP. In AD, the default permissions on the     DNS partition allow creation of new records by     authenticated users. This is used for example to allow     machines to self-register in DNS. If a DNS record was     created that case-insensitively matched the name of the     zone, the ldb_qsort() and dns_name_compare() routines     could be confused into reading memory prior to the list     of DNS entries when responding to DnssrvEnumRecords()     or DnssrvEnumRecords2() and so following invalid memory     as a pointer.(CVE-2019-14861)

  - A flaw was found in samba's Heimdal KDC implementation,     versions 4.8.x up to, excluding 4.8.12, 4.9.x up to,     excluding 4.9.8 and 4.10.x up to, excluding 4.10.3,     when used in AD DC mode. A man in the middle attacker     could use this flaw to intercept the request to the KDC     and replace the user name (principal) in the request     with any desired user name (principal) that exists in     the KDC effectively obtaining a ticket for that     principal.(CVE-2018-16860)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's Heimdal KDC implementation,     versions 4.8.x up to, excluding 4.8.12, 4.9.x up to,     excluding 4.9.8 and 4.10.x up to, excluding 4.10.3,     when used in AD DC mode. A man in the middle attacker     could use this flaw to intercept the request to the KDC     and replace the user name (principal) in the request     with any desired user name (principal) that exists in     the KDC effectively obtaining a ticket for that     principal.(CVE-2018-16860)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the (poorly named) dnsserver RPC pipe provides     administrative facilities to modify DNS records and     zones. Samba, when acting as an AD DC, stores DNS     records in LDAP. In AD, the default permissions on the     DNS partition allow creation of new records by     authenticated users. This is used for example to allow     machines to self-register in DNS. If a DNS record was     created that case-insensitively matched the name of the     zone, the ldb_qsort() and dns_name_compare() routines     could be confused into reading memory prior to the list     of DNS entries when responding to DnssrvEnumRecords()     or DnssrvEnumRecords2() and so following invalid memory     as a pointer.(CVE-2019-14861)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the S4U (MS-SFU) Kerberos delegation model includes a     feature allowing for a subset of clients to be opted     out of constrained delegation in any way, either     S4U2Self or regular Kerberos authentication, by forcing     all tickets for these clients to be non-forwardable. In     AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which     translates to disallow-forwardable. However the Samba     AD DC does not do that for S4U2Self and does set the     forwardable flag even if the impersonated client has     the not-delegated flag set.(CVE-2019-14870)

  - A flaw was found in the samba client, all samba     versions before samba 4.11.2, 4.10.10 and 4.9.15, where     a malicious server can supply a pathname to the client     with separators. This could allow the client to access     files and folders outside of the SMB network pathnames.
    An attacker could use this vulnerability to create     files outside of the current working directory using     the privileges of the client user.(CVE-2019-10218)

  - A flaw was found in the way an LDAP search expression     could crash the shared LDAP server process of a samba     AD DC. An authenticated user, having read permissions     on the LDAP server, could use this flaw to cause denial     of service.(CVE-2019-3824)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ldb fixes the following issue :

Security issue fixed :

  - CVE-2019-3824: Fixed an out-of-bound read vulnerability     in ldb_wildcard_compare (bsc#1125410).

This update was imported from the SUSE:SLE-15:Update update project.

This update for ldb fixes the following issue :

Security issue fixed :

CVE-2019-3824: Fixed an out-of-bound read vulnerability in ldb_wildcard_compare (bsc#1125410).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 4.7.x, 4.8.x, 4.9.x < 4.9.5 or 4.10.0rc prior to 4.10.0rc4. It is, therefore, potentially affected by a denial of service (DoS) vulnerability in the LDAP search expression parser due to improper validation. An authenticated, remote attacker can exploit this issue, via a crafted LDAP search expression, to cause the LDAP server process of the Samba Active Directory Domain Controller to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Garming Sam reported an out-of-bounds read in the ldb_wildcard_compare() function of ldb, a LDAP-like embedded database, resulting in denial of service.

Garming Sam reported an out-of-bounds read in the ldb_wildcard_compare() function of ldb, a LDAP-like embedded database, resulting in denial of service.

For Debian 8 'Jessie', this problem has been fixed in version 2:1.1.20-0+deb8u2.

We recommend that you upgrade your ldb packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LDB incorrectly handled certain search expressions. A remote attacker could possibly use this issue to cause the Samba LDAP process to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
132794	EulerOS Virtualization for ARM 64 3.0.5.0 : samba (EulerOS-SA-2020-1040)	Nessus	Huawei Local Security Checks	critical
132625	EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1032)	Nessus	Huawei Local Security Checks	high
123818	openSUSE Security Update : ldb (openSUSE-2019-1163)	Nessus	SuSE Local Security Checks	medium
122966	SUSE SLED15 / SLES15 Security Update : ldb (SUSE-SU-2019:0639-1)	Nessus	SuSE Local Security Checks	medium
122860	Samba 4.7.x / 4.8.x / 4.9.x < 4.9.5 / 4.10.0rc < 4.10.0rc4 LDAP Search Expression Denial of Service Vulnerability (CVE-2019-3824)	Nessus	Misc.	medium
122516	Debian DSA-4397-1 : ldb - security update	Nessus	Debian Local Security Checks	medium
122515	Debian DLA-1699-1 : ldb security update	Nessus	Debian Local Security Checks	medium
122481	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : LDB vulnerability (USN-3895-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2019-3824

medium

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

medium