A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix.

CVE-2020-1472

Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations.

CVE-2020-10704

An unauthorized user can trigger a denial of service via a stack overflow in the AD DC LDAP server.

CVE-2020-10730

NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results.

CVE-2020-10745

Denial of service resulting from abuse of compression of replies to NetBIOS over TCP/IP name resolution and DNS packets causing excessive CPU load on the Samba AD DC.

CVE-2020-10760

The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free.

CVE-2020-14303

Denial of service resulting from CPU spin and and inability to process further requests once the AD DC NBT server receives an empty (zero-length) UDP packet to port 137.

CVE-2020-14318

Missing handle permissions check in ChangeNotify

CVE-2020-14323

Unprivileged user can crash winbind via invalid lookupsids DoS

CVE-2020-14383

DNS server crash via invalid records resulting from uninitialized variables

For Debian 9 stretch, these problems have been fixed in version 2:4.5.16+dfsg-1+deb9u3.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to its security tracker page at: https://security-tracker.debian.org/tracker/samba

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found when using samba as an Active     Directory Domain Controller. Due to the way samba     handles certain requests as an Active Directory Domain     Controller LDAP server, an unauthorized user can cause     a stack overflow leading to a denial of service. The     highest threat from this vulnerability is to system     availability. This issue affects all samba versions     before 4.10.15, before 4.11.8 and before     4.12.2.(CVE-2020-10704)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ldb, samba fixes the following issues :

Changes in samba :

  - Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

  - Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

  - Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existent paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

  - Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

  - Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

  - Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

  - Add libnetapi-devel to baselibs conf, for wine usage;
    (bsc#1172307);

  - Installing: samba - samba-ad-dc.service does not exist     and unit not found; (bsc#1171437);

  - Fix samba_winbind package is installing python3-base     without python3 package; (bsc#1169521);

Changes in ldb :

  - Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

  - Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

This update was imported from the SUSE:SLE-15-SP2:Update update project.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found when using samba as an Active     Directory Domain Controller. Due to the way samba     handles certain requests as an Active Directory Domain     Controller LDAP server, an unauthorized user can cause     a stack overflow leading to a denial of service. The     highest threat from this vulnerability is to system     availability. This issue affects all samba versions     before 4.10.15, before 4.11.8 and before     4.12.2.(CVE-2020-10704)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for ldb, samba fixes the following issues :

Changes in samba: Update to samba 4.11.11

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159]

  + CVE-2020-10745: invalid DNS or NBT queries containing     dots use several seconds of CPU each; (bso#14378);
    (bsc#1173160).

  + CVE-2020-10760: Use-after-free in AD DC Global Catalog     LDAP server with paged_result or VLV; (bso#14402);
    (bsc#1173161)

  + CVE-2020-14303: Endless loop from empty UDP packet sent     to AD DC nbt_server; (bso#14417); (bsc#1173359).

Update to samba 4.11.10

  + Fix segfault when using SMBC_opendir_ctx() routine for     share folder that contains incorrect symbols in any file     name; (bso#14374).

  + vfs_shadow_copy2 doesn't fail case looking in     snapdirseverywhere mode; (bso#14350)

  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + Malicous SMB1 server can crash libsmbclient; (bso#14366)

  + winbindd: Fix a use-after-free when winbind clients     exit; (bso#14382)

  + ldb: Bump version to 2.0.11, LMDB databases can grow     without bounds. (bso#14330)

Update to samba 4.11.9

  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).

  + 'samba-tool group' commands do not handle group names     with special chars correctly; (bso#14296).

  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo     is not valid; (bso#14237).

  + Missing check for DMAPI offline status in async DOS     attributes; (bso#14293).

  + smbd: Ignore set NTACL requests which contain S-1-5-88     NFS ACEs; (bso#14307).

  + vfs_recycle: Prevent flooding the log if we're called on     non-existant paths; (bso#14316)

  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).

  + RPC handles cannot be differentiated in source3 RPC     server; (bso#14359).

  + librpc: Fix IDL for svcctl_ChangeServiceConfigW;
    (bso#14313).

  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).

  + Fix fruit:time machine max size on arm; (bso#13622)

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294).

  + ctdb: Fix a memleak; (bso#14348).

  + libsmb: Don't try to find posix stat info in     SMBC_getatr().

  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).

  + s3/librpc/crypto: Fix double free with unresolved     credential cache; (bso#14344); (bsc#1169095)

  + s3:libads: Fix ads_get_upn(); (bso#14336).

  + CTDB recovery corner cases can cause record resurrection     and node banning; (bso#14294)

  + Starting ctdb node that was powered off hard before     results in recovery loop; (bso#14295); (bsc#1162680).

  + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap;
    (bso#14324)

Update to samba 4.11.8

  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP     Server with ASQ; (bso#14331); (bsc#1169850);

  + CVE-2020-10704: LDAP Denial of Service (stack overflow)     in Samba AD DC; (bso#14334); (bsc#1169851);

Update to samba 4.11.7

  + s3: lib: nmblib. Clean up and harden nmb packet     processing; (bso#14239).

  + s3: VFS: full_audit. Use system session_info if called     from a temporary share definition; (bso#14283)

  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).

  + ldb: version 2.0.9, Samba 4.11 and later give incorrect     results for SCOPE_ONE searches; (bso#14270)

  + auth: Fix CIDs 1458418 and 1458420 NULL pointer     dereferences; (bso#14247).

  + smbd: Handle EINTR from open(2) properly; (bso#14285)

  + winbind member (source3) fails local SAM auth with empty     domain name; (bso#14247)

  + winbindd: Handling missing idmap in getgrgid();
    (bso#14265).

  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).

  + wafsamba: Do not use 'rU' as the 'U' is deprecated in     Python 3.9; (bso#14266).

  + ctdb-tcp: Make error handling for outbound connection     consistent; (bso#14274).

Update to samba 4.11.6

  + pygpo: Use correct method flags; (bso#14209).

  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).

  + Avoiding bad call flags with python 3.8, using     METH_NOARGS instead of zero; (bso#14209).

  + source4/utils/oLschema2ldif: Include stdint.h before     cmocka.h; (bso#14218).

  + docs-xml/winbindnssinfo: Clarify interaction with     idmap_ad etc; (bso#14122).

  + smbd: Fix the build with clang; (bso#14251).

  + upgradedns: Ensure lmdb lock files linked; (bso#14199).

  + s3: VFS: glusterfs: Reset nlinks for symlink entries     during readdir; (bso#14182).

  + smbc_stat() doesn't return the correct st_mode and also     the uid/gid is not filled (SMBv1) file; (bso#14101).

  + librpc: Fix string length checking in     ndr_pull_charset_to_null(); (bso#14219).

  + ctdb-scripts: Strip square brackets when gathering     connection info; (bso#14227).

Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);

Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);

Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);

Changes in ldb: Update to version 2.0.12

  + CVE-2020-10730: NULL de-reference in AD DC LDAP server     when ASQ and VLV combined; (bso#14364); (bsc#1173159).

  + ldb_ldap: fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).

  + lib/ldb: add unit test for ldb_ldap internal code.

Update to version 2.0.11

  + lib ldb: lmdb init var before calling mdb_reader_check.

  + lib ldb: lmdb clear stale readers on write txn start;
    (bso#14330).

  + ldb tests: Confirm lmdb free list handling

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.10.15

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.11.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issue fixed :

  - CVE-2020-10704: Fixed a stack overflow in the AD DC     (C)LDAP server (bsc#1169851).

Non-security issues fixed :

  - Fixed spnego fallback from kerberos to ntlmssp in smbd     server (bsc#1169473).

  - Fixed warning messages for non root users using     smbclient (bsc#1167070).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The version of Samba running on the remote host is 4.10.x prior to 4.10.15, 4.11.x prior to 4.11.8, or 4.12.x prior to 4.12.2.  It is, therefore, affected by the following vulnerabilities :

  - A flaw exists related to handling 'ASQ' and 'Paged     Results' LDAP controls that could allow use-after-free     conditions having unspecified impact. (CVE-2020-10700)

  - A flaw exists related to handling deeply nested     filters, un-authenticated LDAP searches, and stack     memory that could allow  application crashes.
    (CVE-2020-10704)

Note that Nessus has not tested for these  issues but has instead relied only on the application's self-reported version number.

USN-4341-1 fixed vulnerabilities in Samba. The updated packages for Ubuntu 16.04 LTS introduced a regression when using LDAP. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that Samba incorrectly handled certain LDAP queries.
A remote attacker could possibly use this issue to cause Samba to consume resources, resulting in a denial of service. (CVE-2020-10704).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Samba Team reports :

CVE-2020-10700

A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server.

CVE-2020-10704

A deeply nested filter in an un-authenticated LDAP search can exhaust the LDAP server's stack memory causing a SIGSEGV.

Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS.
(CVE-2020-10700)

It was discovered that Samba incorrectly handled certain LDAP queries.
A remote attacker could possibly use this issue to cause Samba to consume resources, resulting in a denial of service. (CVE-2020-10704).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issue fixed :

CVE-2020-10704: Fixed a stack overflow in the AD DC (C)LDAP server (bsc#1169851).

Non-security issues fixed :

Fixed spnego fallback from kerberos to ntlmssp in smbd server (bsc#1169473).

Fixed warning messages for non root users using smbclient (bsc#1167070).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

CVE-2020-10704: Fixed a stack overflow in the AD DC (C)LDAP server (bsc#1169851).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
143186	Debian DLA-2463-1 : samba security update	Nessus	Debian Local Security Checks	medium
140960	EulerOS Virtualization for ARM 64 3.0.6.0 : samba (EulerOS-SA-2020-2012)	Nessus	Huawei Local Security Checks	high
140174	openSUSE Security Update : ldb / samba (openSUSE-2020-1313)	Nessus	SuSE Local Security Checks	high
139985	EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1882)	Nessus	Huawei Local Security Checks	high
138938	GLSA-202007-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
138790	openSUSE Security Update : ldb / samba (openSUSE-2020-1023)	Nessus	SuSE Local Security Checks	high
138760	SUSE SLED15 / SLES15 Security Update : ldb, samba (SUSE-SU-2020:1948-1)	Nessus	SuSE Local Security Checks	high
136383	Fedora 30 : 2:samba / libldb (2020-e244c98af5)	Nessus	Fedora Local Security Checks	high
136382	Fedora 31 : 2:samba / libldb (2020-9cf0b1c8f1)	Nessus	Fedora Local Security Checks	high
136313	openSUSE Security Update : samba (openSUSE-2020-601)	Nessus	SuSE Local Security Checks	high
136177	Samba 4.10.x < 4.10.15 / 4.11.x < 4.11.8 / 4.12.x < 4.12.2 Multiple Vulnerabilities	Nessus	Misc.	high
136171	Ubuntu 16.04 LTS : Samba regression (USN-4341-3)	Nessus	Ubuntu Local Security Checks	high
136158	FreeBSD : samba -- multiple vulnerabilities (3c7911c9-8a29-11ea-8d8c-005056a311d1)	Nessus	FreeBSD Local Security Checks	high
136084	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba vulnerabilities (USN-4341-1)	Nessus	Ubuntu Local Security Checks	high
136080	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:1133-1)	Nessus	SuSE Local Security Checks	high
136079	SUSE SLES15 Security Update : samba (SUSE-SU-2020:1132-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-10704

high

Tenable Plugins

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high