Attachment 14400 Details for Bug 13434 – Updated CVE text v6.

Updated CVE text v6.

CVE-2018-10919.txt (text/plain), 2.75 KB, created by Jeremy Allison on 2018-08-07 23:39:35 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2018-08-07 23:39:35 UTC

Size: 2.75 KB

patch

obsolete

>====================================================================
>== Subject:     Confidential attribute disclosure from the AD LDAP
>==              server
>==
>== CVE ID#:     CVE-2018-10919
>==
>== Versions:    All versions of Samba from 4.0.0 onwards.
>==
>== Summary:     Missing access control checks allow discovery of
>==              confidential attribute values via authenticated
>==              LDAP search expressions
>==
>====================================================================
>
>===========
>Description
>===========
>
>All versions of the Samba Active Directory LDAP server from 4.0.0
>onwards are vulnerable to the disclosure of confidential attribute
>values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL
>(0x80) searchFlags bit and where an explicit Access Control Entry has
>been specified on the ntSecurityDescriptor.
>
>The confidential attribute disclosure is via the search expression and
>can be seen by the return (or failure to return) matching LDAP
>objects.
>
>This issue does NOT apply to secret attributes such as unicodePwd.
>These values have always been prohibited in LDAP search expressions.
>(Additionally since Samba 4.8 they remain encrypted at search
>expression processing time).
>
>The following attributes in the 2008R2 AD schema have
>SEARCH_FLAG_CONFIDENTIAL set in the searchFlags by default:
>
>unixUserPassword, msFVE-KeyPackage, msFVE-RecoveryPassword,
>msPKIAccountCredentials, msPKIAccountCredentials,
>msPKI-CredentialRoamingTokens, msPKIDPAPIMasterKeys,
>msPKIRoamingTimeStamp, msTPM-OwnerInformation
>
>For clarity: unixUserPassword is NOT populated by Samba.
>
>================
>Remaining issues
>================
>
>Samba makes no attempt to address possible timing attacks against the
>LDAP server.  Data (aside from secret attributes, already subject to
>special processing) of such a sensitivity such that a timing attack
>would be worthwhile should not be stored in Active Directory.
>
>==================
>Patch Availability
>==================
>
>A patch addressing this defect has been posted to
>
>  http://www.samba.org/samba/security/
>
>Additionally, Samba 4.8.4, Samba 4.7.9 and 4.6.16 have been issued as
>a security release to correct the defect.  Patches against older Samba
>versions are available at http://samba.org/samba/patches/. Samba
>vendors and administrators running affected versions are advised to
>upgrade or apply the patch as soon as possible.
>
>==========================
>Workarounds and Mitigation
>==========================
>
>The only workaround is not to use the SEARCH_FLAG_CONFIDENTIAL
>searchFlags bit, not to expect confidentiality of the attribute list
>above nor to set access control entries of a similar nature on LDAP
>objects.
>
>=======
>Credits
>=======
>
>The issue was reported by Phillip Kuhrt.  Tim Beale of Catalyst
>provided the test and patches.

Flags:

obnox: review+
jra: review? (garming)
abartlet: review+

Actions: View

Attachments on bug 13434: 14364 | 14367 | 14368 | 14372 | 14373 | 14374 | 14376 | 14377 | 14378 | 14379 | 14380 | 14383 | 14386 | 14387 | 14388 | 14389 | 14390 | 14391 | 14392 | 14400