Setting to block the next security release as patches are expected very soon.

Created attachment 14644 [details]
draft advisory

Created attachment 14645 [details]
Proposed patch for master

Attached fix for master.

CI link: https://gitlab.catalyst.net.nz/samba/samba.org-security-patches/pipelines/120567

Created attachment 14646 [details]
Proposed changes for v4.9

Attached changes backport for v4.9. (A partial backport of some PEP8/test-code changes, and then the exact same master patches applied on top).

CI link: https://gitlab.catalyst.net.nz/samba/samba.org-security-patches/pipelines/120593

Created attachment 14647 [details]
draft advisory (v2)

Updated the draft advisory. It's actually any setting above 3 minutes that's incorrect, although the behaviour above 3 minutes is a bit unpredictable.

Initially we thought the main problem was the attribute string was too long (for settings > ~16.5 mins), so ldb_msg_find_attr_as_int() was just returning the default (zero). However, for values between ~3.5 and ~16.5 minutes ldb_msg_find_attr_as_int() also has an integer overflow problem where it tries to convert a 64-bit signed integer to a 32-bit signed integer. 

Below is the --reset-account-lockout-after setting on the left, and the actual value the code tries to use on the right. (Where the negative numbers are as effective as zero).

3 mins = 180 secs (OK)
4 mins = -189 secs
5 mins = -129 secs
6 mins = -69 secs
7 mins = -9 secs
8 mins = 50 secs
9 mins = 110 secs
10 mins = 170 secs
11 mins = -198 secs
12 mins = -138 secs
13 mins = -78 secs
14 mins = -18 secs
15 mins = 41 secs
16 mins = 101 secs
17+ mins = 0 secs

This one needs to be addressed in the upcoming sec releases?
We are already late in the process to add vendors. Waiting for patches/advisory here would mean to set a new release date.
Delay or go ahead without this one?

(In reply to Karolin Seeger from comment #6)
Do you want to do two security releases a week apart?

I'm happy with the patches, just need to check the CI links when I'm in office in the morning.

In terms of timeframes, I expect by the end of my work day tomorrow we will have the CI result and the CVE from Red Hat and I'll re-spin all three attachments with those.

Therefore I suggest we wait for this.  Security releases cost our vendors a lot, we shouldn't have two for the AD DC within a fortnight.

Created attachment 14654 [details]
advisory with CVE (v3)

I'll add the CVE to the patches when I get to the office.

Created attachment 14655 [details]
patch for master with CVE (v2)

Created attachment 14656 [details]
backported patch for 4.9 with CVE (v2)

Created attachment 14657 [details]
backported patch for 4.9 with CVE (v3)

For the v4.9 attachment, it had the Reviewed-by tags, but not the CVE number. I've attached an updated patch, with the CVE in the commit headlines.

For the backported dependencies to the test file, I wasn't sure if they should include the CVE or not (I ended up including it, after consulting with Douglas).

Karolin,

This is all good to go.

Thanks!

Opening bug report for vendors.
Planned release date is Tuesday, November 27 2018.

Created attachment 14686 [details]
advisory with CVE (v4)

I've updated the CVSS score to include the numerical score and to re-calibrate it to be more in line with similar issues in the past, specifically:

https://nvd.nist.gov/vuln/detail/CVE-2014-0317
https://nvd.nist.gov/vuln/detail/CVE-2013-4496

This was a similar issue (on Windows/Samba) where the bad password count was bypassed.  These got scores of 5.4 and 5.0 on the CVS/2.0

Samba 4.9.3 has been shipped to address this defect.

Pushed to autobuild-master.

(In reply to Karolin Seeger from comment #17)
Pushed to master.
Closing out bug report.

Thanks!