SUSE SLED15: ctdb / ldb-tools / libdcerpc-binding0 / libdcerpc-binding0-32bit / etc (SUSE-SU-2021:3647-1)

high Nessus Plugin ID 155048

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3647-1 advisory.

- CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).
- CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
- CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
- CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).
- CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
- CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).
- CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).
- CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

* rodc_rwdc test flaps;(bso#14868).
* Backport bronze bit fixes, tests, and selftest improvements;
(bso#14881).
* Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642).
* Python ldb.msg_diff() memory handling failure;(bso#14836).
* 'in' operator on ldb.Message is case sensitive;(bso#14845).
* Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
* Allow special chars like '@' in samAccountName when generating the salt;(bso#14874).
* Fix transit path validation;(bso#12998).
* Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
* rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645).
* Python ldb.msg_diff() memory handling failure;(bso#14836).
* Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

* Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806).
* Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache;
(bso#14807).
* An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
* Address flapping samba_tool_drs_showrepl test;(bso#14818).
* Address flapping dsdb_schema_attributes test;(bso#14819).
* An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817).
* Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

* smbd: panic on force-close share during offload write; (bso#14769).
* Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731).
* smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
* net conf list crashes when run as normal user;(bso#14787).
* Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607).
* Start the SMB encryption as soon as possible;(bso#14793).
* Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

+ CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);
(bso#14558) + CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

+ Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
+ Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836) + Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 155048

File Name: suse_SU-2021-3647-1.nasl

Version: 1.10

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/11/2021

Updated: 6/25/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2020-25719

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2021-3738

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libldb2, p-cpe:/a:novell:suse_linux:libdcerpc0-32bit, p-cpe:/a:novell:suse_linux:python3-ldb-devel, p-cpe:/a:novell:suse_linux:libsmbldap2-32bit, p-cpe:/a:novell:suse_linux:samba-ad-dc, p-cpe:/a:novell:suse_linux:libndr-devel, p-cpe:/a:novell:suse_linux:samba-winbind-32bit, p-cpe:/a:novell:suse_linux:samba-python3, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:libnetapi-devel, p-cpe:/a:novell:suse_linux:samba-libs-32bit, p-cpe:/a:novell:suse_linux:python3-ldb, p-cpe:/a:novell:suse_linux:ctdb, p-cpe:/a:novell:suse_linux:libtevent-util0, p-cpe:/a:novell:suse_linux:libdcerpc-samr-devel, p-cpe:/a:novell:suse_linux:libsmbldap2, p-cpe:/a:novell:suse_linux:libtevent-util-devel, p-cpe:/a:novell:suse_linux:samba-core-devel, p-cpe:/a:novell:suse_linux:libndr-krb5pac0, p-cpe:/a:novell:suse_linux:libndr-krb5pac-devel, p-cpe:/a:novell:suse_linux:libndr-nbt0-32bit, p-cpe:/a:novell:suse_linux:libsamba-credentials0-32bit, p-cpe:/a:novell:suse_linux:libsamba-passdb0-32bit, p-cpe:/a:novell:suse_linux:samba-gpupdate, p-cpe:/a:novell:suse_linux:libsmbconf0-32bit, p-cpe:/a:novell:suse_linux:libsmbclient0, p-cpe:/a:novell:suse_linux:libsamdb0, p-cpe:/a:novell:suse_linux:libldb-devel, p-cpe:/a:novell:suse_linux:samba-libs-python3, p-cpe:/a:novell:suse_linux:libdcerpc-devel, p-cpe:/a:novell:suse_linux:samba-dsdb-modules, p-cpe:/a:novell:suse_linux:libsmbconf0, p-cpe:/a:novell:suse_linux:libwbclient-devel, p-cpe:/a:novell:suse_linux:libdcerpc-binding0-32bit, p-cpe:/a:novell:suse_linux:libsamba-policy0-python3, p-cpe:/a:novell:suse_linux:libnetapi0, p-cpe:/a:novell:suse_linux:libdcerpc-samr0, p-cpe:/a:novell:suse_linux:libsamba-errors0, p-cpe:/a:novell:suse_linux:ldb-tools, p-cpe:/a:novell:suse_linux:libndr-nbt-devel, p-cpe:/a:novell:suse_linux:samba-libs, p-cpe:/a:novell:suse_linux:libndr-standard0, p-cpe:/a:novell:suse_linux:libnetapi0-32bit, p-cpe:/a:novell:suse_linux:libsamba-util-devel, p-cpe:/a:novell:suse_linux:libwbclient0-32bit, p-cpe:/a:novell:suse_linux:libsamba-util0, p-cpe:/a:novell:suse_linux:libndr-krb5pac0-32bit, p-cpe:/a:novell:suse_linux:libsmbconf-devel, p-cpe:/a:novell:suse_linux:libldb2-32bit, p-cpe:/a:novell:suse_linux:libsmbclient-devel, p-cpe:/a:novell:suse_linux:samba-ceph, p-cpe:/a:novell:suse_linux:libsamba-credentials0, p-cpe:/a:novell:suse_linux:libdcerpc0, p-cpe:/a:novell:suse_linux:libndr1, p-cpe:/a:novell:suse_linux:libsamba-policy-python3-devel, p-cpe:/a:novell:suse_linux:libndr-standard0-32bit, p-cpe:/a:novell:suse_linux:libndr1-32bit, p-cpe:/a:novell:suse_linux:samba-winbind, p-cpe:/a:novell:suse_linux:libsamba-errors-devel, p-cpe:/a:novell:suse_linux:libsamba-hostconfig0-32bit, p-cpe:/a:novell:suse_linux:libsamba-credentials-devel, p-cpe:/a:novell:suse_linux:libtevent-util0-32bit, p-cpe:/a:novell:suse_linux:samba-client, p-cpe:/a:novell:suse_linux:libsamba-hostconfig-devel, p-cpe:/a:novell:suse_linux:libsamba-passdb0, p-cpe:/a:novell:suse_linux:libsamdb-devel, p-cpe:/a:novell:suse_linux:libsamdb0-32bit, p-cpe:/a:novell:suse_linux:samba-ldb-ldap, p-cpe:/a:novell:suse_linux:libsamba-policy-devel, p-cpe:/a:novell:suse_linux:libndr-nbt0, p-cpe:/a:novell:suse_linux:libndr-standard-devel, p-cpe:/a:novell:suse_linux:libsamba-hostconfig0, p-cpe:/a:novell:suse_linux:libwbclient0, p-cpe:/a:novell:suse_linux:libsamba-passdb-devel, p-cpe:/a:novell:suse_linux:libsamba-util0-32bit, p-cpe:/a:novell:suse_linux:libdcerpc-binding0, p-cpe:/a:novell:suse_linux:libsmbldap-devel, p-cpe:/a:novell:suse_linux:libsamba-errors0-32bit, p-cpe:/a:novell:suse_linux:samba

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/10/2021

Vulnerability Publication Date: 11/9/2021

Reference Information

CVE: CVE-2016-2124, CVE-2020-25717, CVE-2020-25718, CVE-2020-25719, CVE-2020-25721, CVE-2020-25722, CVE-2021-23192, CVE-2021-3738

IAVA: 2021-A-0554-S

SuSE: SUSE-SU-2021:3647-1

Detections

Analytics