Attachment 12733 Details for Bug 12445 – Fixed up version v2

Fixed up version v2

CVE-2016-2125-description.metze03.txt (text/plain), 4.04 KB, created by Douglas Bagnall on 2016-12-07 03:10:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Douglas Bagnall

Created: 2016-12-07 03:10:36 UTC

Size: 4.04 KB

patch

obsolete

>===============================================================================
>== Subject:     Unconditional Kerberos delegation to all servers.
>==
>== CVE ID#:     CVE-2016-2125
>==
>== Versions:    Samba 3.0.25 to 4.5.2
>==
>== Summary:     Samba client code always requests a forwardable ticket
>==              when using kerberos authentication. This means the
>==              target server is given a valid general purpose
>==              Kerberos "Ticket Granting Ticket" (TGT), which can
>==              be used to fully impersonate the authenticated user.
>==
>================================================================================
>
>===========
>Description
>===========
>
>Whenever the Samba client code uses GSSAPI/Kerberos authentication it
>requests a forwardable ticket by passing the GSS_C_DELEG_FLAG flag to
>the gss_init_sec_context() GSSAPI function.
>
>Because of this a forwardable TGT is always requested from the KDC and
>passed (via the kerberos AP-REQ) to the remote server. This
>forwardable TGT is basically a normal TGT, which can be used by the
>remote service to get service tickets on behalf of the user for any
>other service from the KDC.
>
>The service that accepts the AP-REQ from the client can thus do
>whatever the client is also able to do (impersonate the client).
>
>In the Active Directory world it's possible for administrators to
>limit the delegation. User and computer objects can both act as
>kerberos users and also as kerberos services. They both have an
>attribute called 'userAccountControl' which is a bitmask that controls
>the behavior of the account. The following three values have impact on
>possible delegation:
>
>0x00100000: UF_NOT_DELEGATED:
>
>The UF_NOT_DELEGATED can be used to disable the ability to get
>forwardable TGT for the account. It means the KDC will respond with
>an error if the client asks for the forwardable ticket.  The client
>typically gives up and removes the GSS_C_DELEG_FLAG flag and continues
>without passing delegated credentials.  Administrators can use this to
>disable possible delegation for the most privileged accounts
>(e.g. administrator accounts).
>
>0x00080000: UF_TRUSTED_FOR_DELEGATION
>
>If the UF_TRUSTED_FOR_DELEGATION is set on an account a KDC will
>include the OK_AS_DELEGATE flag in a granted service ticket.  If the
>client application uses just GSS_C_DELEG_POLICY_FLAG (instead of
>GSS_C_DELEG_FLAG) gssapi/kerberos libraries typically only include
>delegated credentials when the service ticket includes the
>OK_AS_DELEGATE flag. Administrators can use this to control which
>services will get delegated credentials, usually reserving this for
>services that run in a trusted environment and actually require the
>presence of delegated credentials.
>
>0x01000000: UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
>
>The UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION is not really relevant
>for this CVE and just listed in order to have a complete list. The
>UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION flag is relevant for the
>S4U2Proxy feature, where a service can ask the KDC for a proxied
>service tickets which can impersonate users to other services.
>
>The patched Samba version will still use GSS_C_DELEG_POLICY_FLAG and
>provide delegated credentials to services which have the
>UF_TRUSTED_FOR_DELEGATION bitmask set on the user account.
>
>==================
>Patch Availability
>==================
>
>A patch addressing this defect has been posted to
>
>  https://www.samba.org/samba/security/
>
>Additionally, Samba 4.5.3, 4.4.8 and 4.3.13 have been issued as
>security releases to correct the defect. Samba vendors and
>administrators running affected versions are advised to upgrade or
>apply the patch as soon as possible.
>
>==========
>Workaround
>==========
>
>See the description about UF_NOT_DELEGATED above.
>
>Some (but NOT all!) tools make use of the undocumented
>"gensec_gssapi:delegation=no" option in the [global] section of the
>smb.conf file.
>
>=======
>Credits
>=======
>
>This vulnerability was discovered by Simo Sorce of RedHat and
>researched by Stefan Metzmacher of SerNet (https://samba.plus) both
>members of the Samba Team (https://www.samba.org). Stefan Metzmacher
>also provided the fixes.

Actions: View

Attachments on bug 12445: 12707 | 12708 | 12709 | 12710 | 12711 | 12730 | 12732 | 12733 | 12735 | 12736 | 12737 | 12739 | 12766 | 12772