Attachment 15584 Details for Bug 14138 – first draft security advisory

first draft security advisory

CVE-2019-14861-dnsserver-advisory-01.txt (text/plain), 2.24 KB, created by Andrew Bartlett on 2019-10-30 03:16:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2019-10-30 03:16:44 UTC

Size: 2.24 KB

patch

obsolete

>===========================================================
>== Subject:     Samba AD DC zone-named record Denial of 
>==              Service in DNS management server (dnsserver)
>==
>== CVE ID#:     CVE-2019-1486
>==
>== Versions:    All Samba versions since Samba 4.0
>==
>== Summary:     An authenticated user can crash the DCE/RPC DNS
>==              management server by creating records with matching
>==              the zone name
>===========================================================
>
>===========
>Description
>===========
>
>The (poorly named) dnsserver RPC pipe provides administrative
>facilities to modify DNS records and zones.
>
>Samba, when acting at an AD DC, stores DNS records in LDAP.
>
>In AD, the default permissions on the DNS partition allow creation of
>new records by authenticated users.  This is used for example to allow
>machines to self-register in DNS.
>
>If a DNS record was created that case-wise matched the name of the
>zone, the ldb_qsort() and dns_name_compare() routines could be
>confused into reading memory prior to the list of DNS entries when
>responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so
>following invalid memory as a pointer. 
>
>There is no further vulnerability associated with this issue, merely a
>denial of service.
>
>==================
>Patch Availability
>==================
>
>Patches addressing both these issues have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba 4.11.3, 4.10.11 and 4.9.16 have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (5.3)
>
>==========
>Workaround
>==========
>
>The dnsserver task can be stopped by setting 
> 'dcerpc endpoint servers = -dnsserver'
>in the smb.conf and restarting Samba. 
>
>=======
>Credits
>=======
>
>Originally reported by Andreas Oster.
>
>Patches provided by Andrew Bartlett of the Samba Team and Catalyst.
>Advisory written by Andrew Bartlett of the Samba Team and Catalyst.
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Actions: View

Attachments on bug 14138: 15560 | 15574 | 15579 | 15580 | 15581 | 15582 | 15583 | 15584 | 15590 | 15591 | 15595 | 15596 | 15597 | 15598 | 15647 | 15649 | 15674