Attachment 14038 Details for Bug 13272 – CVE-2018-1057-description.metze04.ks_v2.txt

CVE-2018-1057-description.metze04.ks_v2.txt

bso10549_advisory_v4.txt (text/plain), 2.40 KB, created by Karolin Seeger on 2018-03-13 07:53:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Karolin Seeger

Created: 2018-03-13 07:53:17 UTC

Size: 2.40 KB

patch

obsolete

>====================================================================
>== Subject:     Authenticated users can change other users' password
>==
>== CVE ID#:     CVE-2018-1057
>==
>== Versions:    All versions of Samba from 4.0.0 onwards.
>==
>== Summary:     On a Samba 4 AD DC any authenticated user can change
>==              other users' passwords over LDAP, including the
>==              passwords of administrative users.
>==
>====================================================================
>
>===========
>Description
>===========
>
>On a Samba 4 AD DC the LDAP server in all versions of Samba from
>4.0.0 onwards incorrectly validates permissions to modify passwords
>over LDAP allowing authenticated users to change any other users'
>passwords, including administrative users.
>
>The LDAP server incorrectly validates certain LDAP password
>modifications against the "Change Password" privilege, but then
>performs a password reset operation.
>
>The change password right in AD is an extended object access right
>with the GUID ab721a53-1e2f-11d0-9819-00aa0040529b.
>
>By default user objects grant the change password right to the
>authenticated user's own user object (self) and to everyone
>(world). Computer objects grant the change password right to
>everyone.
>
>The corresponding ACEs expressed in SDDL are
>
>self:  (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)
>world: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)
>
>The components of these ACEs are
>
>OA: object access allowed
>CR: extended rights
>PS: trustee: self
>WD: trustee: world/everyone
>
>The problematic ACE is the one for world/everyone.
>
>The Windows GUI shows this as "Change password" right granted to
>"Everyone".
>
>==========
>Workaround
>==========
>
>Possible workarounds are described at a dedicated page in the Samba wiki:
>
>https://wiki.samba.org/index.php/CVE-2018-1057
>
>==================
>Patch Availability
>==================
>
>A patch addressing this defect has been posted to
>
>  https://www.samba.org/samba/security/
>
>Additionally, Samba 4.7.6, 4.6.14 and 4.5.16 have been issued as
>security releases to correct the defect. Patches against older Samba
>versions may be available at https://samba.org/samba/patches/. Samba
>vendors and administrators running affected versions are advised to
>upgrade or apply the patch as soon as possible.
>
>=======
>Credits
>=======
>
>This problem was found by BjÃ¶rn Baumbach from Sernet. Ralph BÃ¶hme and
>Stefan Metzmacher from SerNet and the Samba Team provided the fix.

Actions: View

Attachments on bug 13272: 13977 | 13978 | 14008 | 14009 | 14010 | 14011 | 14016 | 14028 | 14029 | 14030 | 14031 | 14032 | 14033 | 14034 | 14035 | 14036 | 14038 | 14039 | 14040 | 14041 | 14042 | 14043 | 14044 | 14045 | 14047 | 14048