Attachment 16913 Details for Bug 14875 – advisory text (v01)

advisory text (v01)

CVE-2021-23192-advisory-v1.txt (text/plain), 2.13 KB, created by Andrew Bartlett on 2021-11-02 08:30:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2021-11-02 08:30:06 UTC

Size: 2.13 KB

patch

obsolete

>===========================================================
>== Subject:     Subsequent DCE/RPC fragment injection vulnerability
>==              (AD DC concern)
>==
>== CVE ID#:     CVE-2021-23192
>==
>== Versions:    Samba 4.0.0 and later.
>==
>== Summary:     If a client to a Samba server sent a very large
>                DCE/RPC request, and chose to fragment it, an
>		attacker could replace later fragments with
>		their own data, bypassign the signature requirements.
>===========================================================
>
>===========
>Description
>===========
>
>Samba implements DCE/RPC, and in most cases it is provided over and
>protected by the underlying SMB transport, with protections like 'SMB
>signing'.
>
>Hoever in the Samba AD DC in particular Samba and servers working with
>Samba may exchange large DCE/RPC payloads directly over TCP/IP,
>protected with GSSAPI/Kerberos for DRS replication - replication of
>the AD users and their passwords.
>
>Because the checks on the fragment protection were not done between
>the policy controls on the header and the subsequent fragments, an
>attacker could replace subseuqnet fragments in requests or replies
>with their own data.
>
>==================
>Patch Availability
>==================
>
>Patches addressing both these issues have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba 4.15.2, 4.14.10 and 4.13.14 have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8)
>
>==========
>Workaround
>==========
>
>Setting "dcesrv:max auth states=0" in the smb.conf will provide
>some mitigation against this issue.
>
>=======
>Credits
>=======
>
>Originally reported by Stefan Metzmacher of SerNet
>
>Patches provided by Stefan Metzmacher of SerNet and the Samba Team.
>Advisory by Andrew Bartlett of Catalyst and the Samba Team.
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Actions: View

Attachments on bug 14875: 16887 | 16888 | 16889 | 16901 | 16913 | 16915 | 16919 | 16920 | 16923 | 16928 | 16929 | 16960 | 16962 | 16968 | 16974