Attachment 16915 Details for Bug 14875 – CVE-2021-23192-description.metze02.txt

CVE-2021-23192-description.metze02.txt

CVE-2021-23192-description.metze02.txt (text/plain), 2.63 KB, created by Stefan Metzmacher on 2021-11-02 09:49:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Metzmacher

Created: 2021-11-02 09:49:19 UTC

Size: 2.63 KB

patch

obsolete

>====================================================================
>== Subject:     Subsequent DCE/RPC fragment injection vulnerability
>==              (AD DC concern)
>==
>== CVE ID#:     CVE-2021-23192
>==
>== Versions:    Samba 4.10.0 and later.
>==
>== Summary:     If a client to a Samba server sent a very large
>                DCE/RPC request, and chose to fragment it, an
>		attacker could replace later fragments with
>		their own data, bypassign the signature requirements.
>=====================================================================
>
>===========
>Description
>===========
>
>Samba implements DCE/RPC, and in most cases it is provided over and
>protected by the underlying SMB transport, with protections like 'SMB
>signing'.
>
>Hoever in the Samba AD DC in particular Samba and servers working with
>Samba may exchange large DCE/RPC payloads directly over TCP/IP,
>protected with GSSAPI/Kerberos for DRS replication - replication of
>the AD users and their passwords.
>
>Because the checks on the fragment protection were not done between
>the policy controls on the header and the subsequent fragments, an
>attacker could replace subsequent fragments in requests
>with their own data, which might be able to alter the server
>behaviour.
>
>==================
>Patch Availability
>==================
>
>Patches addressing both these issues have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba 4.15.2, 4.14.10 and 4.13.14 have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8)
>
>==========
>Workaround
>==========
>
>Setting "dcesrv:max auth states=0" in the smb.conf will provide
>some mitigation against this issue.
>
>But it disables "Security Context Multiplexing" and may reopens
>https://bugzilla.samba.org/show_bug.cgi?id=11892,
>which means domain members running things like Cisco ISE or
>VMWare View may no longer work. This applies only to
>active directory domain controllers.
>
>Note the related code was ported to the domain member
>and the legacy NT4/classic domain controller with
>Samba 4.12.0, but there are no known problems with
>"dcesrv:max auth states=0".
>
>=======
>Credits
>=======
>
>Originally reported by Stefan Metzmacher of SerNet
>
>Patches provided by Stefan Metzmacher of SerNet and the Samba Team.
>Advisory by Andrew Bartlett of Catalyst and the Samba Team.
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Flags:

abartlet: review+

Actions: View

Attachments on bug 14875: 16887 | 16888 | 16889 | 16901 | 16913 | 16915 | 16919 | 16920 | 16923 | 16928 | 16929 | 16960 | 16962 | 16968 | 16974