The Samba-Bugzilla – Attachment 16913 Details for
Bug 14875
CVE-2021-23192 [SECURITY] dcerpc requests don't check all fragments against the first auth_state
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
advisory text (v01)
CVE-2021-23192-advisory-v1.txt (text/plain), 2.13 KB, created by
Andrew Bartlett
on 2021-11-02 08:30:06 UTC
(
hide
)
Description:
advisory text (v01)
Filename:
MIME Type:
Creator:
Andrew Bartlett
Created:
2021-11-02 08:30:06 UTC
Size:
2.13 KB
patch
obsolete
>=========================================================== >== Subject: Subsequent DCE/RPC fragment injection vulnerability >== (AD DC concern) >== >== CVE ID#: CVE-2021-23192 >== >== Versions: Samba 4.0.0 and later. >== >== Summary: If a client to a Samba server sent a very large > DCE/RPC request, and chose to fragment it, an > attacker could replace later fragments with > their own data, bypassign the signature requirements. >=========================================================== > >=========== >Description >=========== > >Samba implements DCE/RPC, and in most cases it is provided over and >protected by the underlying SMB transport, with protections like 'SMB >signing'. > >Hoever in the Samba AD DC in particular Samba and servers working with >Samba may exchange large DCE/RPC payloads directly over TCP/IP, >protected with GSSAPI/Kerberos for DRS replication - replication of >the AD users and their passwords. > >Because the checks on the fragment protection were not done between >the policy controls on the header and the subsequent fragments, an >attacker could replace subseuqnet fragments in requests or replies >with their own data. > >================== >Patch Availability >================== > >Patches addressing both these issues have been posted to: > > https://www.samba.org/samba/security/ > >Additionally, Samba 4.15.2, 4.14.10 and 4.13.14 have been issued >as security releases to correct the defect. Samba administrators are >advised to upgrade to these releases or apply the patch as soon >as possible. > >================== >CVSSv3 calculation >================== > >CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8) > >========== >Workaround >========== > >Setting "dcesrv:max auth states=0" in the smb.conf will provide >some mitigation against this issue. > >======= >Credits >======= > >Originally reported by Stefan Metzmacher of SerNet > >Patches provided by Stefan Metzmacher of SerNet and the Samba Team. >Advisory by Andrew Bartlett of Catalyst and the Samba Team. > >========================================================== >== Our Code, Our Bugs, Our Responsibility. >== The Samba Team >========================================================== >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 14875
:
16887
|
16888
|
16889
|
16901
|
16913
|
16915
|
16919
|
16920
|
16923
|
16928
|
16929
|
16960
|
16962
|
16968
|
16974