SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   Samba Vendors:   Samba.org
(Red Hat Issues Fix) Samba Multiple Flaws Let Remote Users Hijack Connections, Obtain Potentially Sensitive Information, and Deny Service
SecurityTracker Alert ID:  1035545
SecurityTracker URL:  http://securitytracker.com/id/1035545
CVE Reference:   CVE-2015-5370, CVE-2016-2111, CVE-2016-2112, CVE-2016-2115, CVE-2016-2118   (Links to External Site)
Date:  Apr 13 2016
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0.0 to 4.4.0
Description:   Multiple vulnerabilities were reported in Samba. A remote user can cause denial of service conditions on the target system. A remote user can hijack connection. A remote user can obtain potentially sensitive information on the target system.

A remote authenticated user can exploit a missing error check in dcesrv_auth_bind_ack() in the DCE/RPC protocol implementation to cause excessive CPU consumption on the target system or cause the target service to crash or execute arbitrary code [CVE-2015-5370]. Versions 3.6.0 to 4.4.0 are affected.

The NTLMSSP implementation is not protected against downgrading. A remote user that can conduct a man-in-the-middle attack can hijack the target connection [CVE-2016-2110].

The NTLMSSP implementation is not protected against downgrading. A remote user that can conduct a man-in-the-middle attack can spoof a system name to a Domain Controller and obtain session-related information about the spoofed system [CVE-2016-2111].

The LDAP implementation does not enforce integrity protection for LDAP connections. A remote user that can conduct a man-in-the-middle attack can downgrade the target LDAP connection to use no integrity protection and gain access to the connection [CVE-2016-2112].

A remote user that can conduct a man-in-the-middle attack can gain access to LDAP connection [CVE-2016-2113]. Versions 4.0.0 to 4.4.0 are affected.

The system does not enforce the mandatory server signing configuration setting. As a result, a remote user can conduct a man-in-the-middle attack to hijack SMB1 connections [CVE-2016-2114]. Versions 4.0.0 to 4.4.0 are affected.

The IPC implementation does not enforce integrity protection by default. A remote user that can conduct a man-in-the-middle attacker can view and modify data sent via the IPC connection [CVE-2016-2115].

A remote user that can conduct a man-in-the-middle attack against DCE/RPE connections can impersonate the target user against the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD) implementations to obtain read/write access to the target Security Account Manager database [CVE-2016-2118]. This can be exploited to obtain passwords in the database. Versions 3.6.0 to 4.4.0 are affected.

[Editor's note: Microsoft Windows is also affected by this vulnerability, as described in CVE-2016-0128 (Alert ID 1035534). This vulnerability is known as "Badlock".]

Jouni Knuutinen of Synopsys reported the dcesrv_auth_bind_ack() vulnerability. Stefan Metzmacher of SerNet (https://samba.plus) reported the other vulnerabilities.

Impact:   A remote user can cause denial of service conditions.

A remote user can obtain potentially sensitive information on the target system.

A remote user can hijack connections.

Solution:   Red Hat has issued a fix for CVE-2015-5370, CVE-2016-2111, CVE-2016-2112, CVE-2016-2115, and CVE-2016-2118.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2016-0611.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2016-0611.html (Links to External Site)
Cause:   Access control error, Authentication error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  6

Message History:   This archive entry is a follow-up to the message listed below.
Apr 13 2016 Samba Multiple Flaws Let Remote Users Hijack Connections, Obtain Potentially Sensitive Information, and Deny Service



 Source Message Contents

Subject:  [RHSA-2016:0611-01] Critical: samba security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: samba security update
Advisory ID:       RHSA-2016:0611-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-0611.html
Issue date:        2016-04-12
CVE Names:         CVE-2015-5370 CVE-2016-2111 CVE-2016-2112 
                   CVE-2016-2115 CVE-2016-2118 
=====================================================================

1. Summary:

An update for samba is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

Samba is an open-source implementation of the Server Message Block (SMB)
protocol and the related Common Internet File System (CIFS) protocol, which
allow PC-compatible machines to share files, printers, and various
information.

Security Fix(es):

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A
remote, authenticated attacker could use these flaws to cause a denial of
service against the Samba server (high CPU load or a crash) or, possibly,
execute arbitrary code with the permissions of the user running Samba
(root). This flaw could also be used to downgrade a secure DCE/RPC
connection by a man-in-the-middle attacker taking control of an Active
Directory (AD) object and compromising the security of a Samba Active
Directory Domain Controller (DC). (CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Enterprise Linux do not
support running Samba as an AD DC, this flaw applies to all roles Samba
implements.

* A protocol flaw, publicly referred to as Badlock, was found in the
Security Account Manager Remote Protocol (MS-SAMR) and the Local Security
Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated
DCE/RPC connection that a client initiates against a server could be used
by a man-in-the-middle attacker to impersonate the authenticated user
against the SAMR or LSA service on the server. As a result, the attacker
would be able to get read/write access to the Security Account Manager
database, and use this to reveal all passwords or any other potentially
sensitive information in that database. (CVE-2016-2118)

* It was discovered that Samba configured as a Domain Controller would
establish a secure communication channel with a machine using a spoofed
computer name. A remote attacker able to observe network traffic could use
this flaw to obtain session-related information about the spoofed machine.
(CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity
protection for LDAP connections. A man-in-the-middle attacker could use
this flaw to downgrade LDAP connections to use no integrity protection,
allowing them to hijack such connections. (CVE-2016-2112)

* It was found that Samba did not enable integrity protection for IPC
traffic by default. A man-in-the-middle attacker could use this flaw to
view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues.
Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter
of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter
of CVE-2016-2118, CVE-2016-2112, and CVE-2016-2115.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1309987 - CVE-2015-5370 samba: crash in dcesrv_auth_bind_ack due to missing error check
1311902 - CVE-2016-2111 samba: Spoofing vulnerability when domain controller is configured
1311903 - CVE-2016-2112 samba: Missing downgrade detection
1312084 - CVE-2016-2115 samba: Smb signing not required by default when smb client connection is used for ipc usage
1317990 - CVE-2016-2118 samba: SAMR and LSA man in the middle attacks

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

i386:
libsmbclient-3.6.23-30.el6_7.i686.rpm
samba-client-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-winbind-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
samba-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-doc-3.6.23-30.el6_7.i686.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.i686.rpm
samba-swat-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

x86_64:
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

i386:
libsmbclient-3.6.23-30.el6_7.i686.rpm
samba-3.6.23-30.el6_7.i686.rpm
samba-client-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-winbind-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm

ppc64:
libsmbclient-3.6.23-30.el6_7.ppc.rpm
libsmbclient-3.6.23-30.el6_7.ppc64.rpm
samba-3.6.23-30.el6_7.ppc64.rpm
samba-client-3.6.23-30.el6_7.ppc64.rpm
samba-common-3.6.23-30.el6_7.ppc.rpm
samba-common-3.6.23-30.el6_7.ppc64.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-clients-3.6.23-30.el6_7.ppc.rpm
samba-winbind-clients-3.6.23-30.el6_7.ppc64.rpm

s390x:
libsmbclient-3.6.23-30.el6_7.s390.rpm
libsmbclient-3.6.23-30.el6_7.s390x.rpm
samba-3.6.23-30.el6_7.s390x.rpm
samba-client-3.6.23-30.el6_7.s390x.rpm
samba-common-3.6.23-30.el6_7.s390.rpm
samba-common-3.6.23-30.el6_7.s390x.rpm
samba-debuginfo-3.6.23-30.el6_7.s390.rpm
samba-debuginfo-3.6.23-30.el6_7.s390x.rpm
samba-winbind-3.6.23-30.el6_7.s390x.rpm
samba-winbind-clients-3.6.23-30.el6_7.s390.rpm
samba-winbind-clients-3.6.23-30.el6_7.s390x.rpm

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

i386:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-doc-3.6.23-30.el6_7.i686.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.i686.rpm
samba-swat-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.i686.rpm

ppc64:
libsmbclient-devel-3.6.23-30.el6_7.ppc.rpm
libsmbclient-devel-3.6.23-30.el6_7.ppc64.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc64.rpm
samba-doc-3.6.23-30.el6_7.ppc64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.ppc64.rpm
samba-swat-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-devel-3.6.23-30.el6_7.ppc.rpm
samba-winbind-devel-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.ppc64.rpm

s390x:
libsmbclient-devel-3.6.23-30.el6_7.s390.rpm
libsmbclient-devel-3.6.23-30.el6_7.s390x.rpm
samba-debuginfo-3.6.23-30.el6_7.s390.rpm
samba-debuginfo-3.6.23-30.el6_7.s390x.rpm
samba-doc-3.6.23-30.el6_7.s390x.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.s390x.rpm
samba-swat-3.6.23-30.el6_7.s390x.rpm
samba-winbind-devel-3.6.23-30.el6_7.s390.rpm
samba-winbind-devel-3.6.23-30.el6_7.s390x.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.s390x.rpm

x86_64:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

i386:
libsmbclient-3.6.23-30.el6_7.i686.rpm
samba-3.6.23-30.el6_7.i686.rpm
samba-client-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-winbind-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

i386:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-doc-3.6.23-30.el6_7.i686.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.i686.rpm
samba-swat-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5370
https://access.redhat.com/security/cve/CVE-2016-2111
https://access.redhat.com/security/cve/CVE-2016-2112
https://access.redhat.com/security/cve/CVE-2016-2115
https://access.redhat.com/security/cve/CVE-2016-2118
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/badlock
https://access.redhat.com/articles/2253041
http://badlock.org/
https://access.redhat.com/articles/2243351

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFXDVptXlSAg2UNWIIRAoPsAJ9zdtJa0gFvYDzspH9btOqxbcdx8ACfcxka
n90FVGdsCjAGhLucjiL7fKI=
=4KMh
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC