====================================================================

                             CERT-Renater

                 Note d'Information No. 2018/VULN097
_____________________________________________________________________

DATE                : 14/03/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Samba versions 4 prior to 4.7.6,
                               4.6.14, 4.5.16.

=====================================================================
https://www.samba.org/samba/security/CVE-2018-1050.html
https://www.samba.org/samba/security/CVE-2018-1057.html
_____________________________________________________________________

CVE-2018-1050.html

====================================================================
== Subject:     Denial of Service Attack on external print server.
==
== CVE ID#:     CVE-2018-1050
==
== Versions:    All versions of Samba from 4.0.0 onwards.
==
== Summary:     Missing null pointer checks may crash the external
==		print server process.
==
====================================================================

===========
Description
===========

All versions of Samba from 4.0.0 onwards are vulnerable to a denial of
service attack when the RPC spoolss service is configured to be run as
an external daemon. Missing input sanitization checks on some of the
input parameters to spoolss RPC calls could cause the print spooler
service to crash.

There is no known vulnerability associated with this error, merely a
denial of service. If the RPC spoolss service is left by default as an
internal service, all a client can do is crash its own authenticated
connection.

==================
Patch Availability
==================

A patch addressing this defect has been posted to

  http://www.samba.org/samba/security/

Additionally, Samba 4.7.6, 4.6.14 and 4.5.16 have been issued as
security releases to correct the defect. Patches against older Samba
versions are available at http://samba.org/samba/patches/. Samba
vendors and administrators running affected versions are advised to
upgrade or apply the patch as soon as possible.

==========
Workaround
==========

Ensure the parameter:

rpc_server:spoolss = external

is not set in the [global] section of your smb.conf.

=======
Credits
=======

This problem was found by the Synopsys Defensics intelligent fuzz
testing tool.  Jeremy Allison of Google and the Samba Team provided
the fix.

_____________________________________________________________________

CVE-2018-1057.html

====================================================================
== Subject:     Authenticated users can change other users' password
==
== CVE ID#:     CVE-2018-1057
==
== Versions:    All versions of Samba from 4.0.0 onwards.
==
== Summary:     On a Samba 4 AD DC any authenticated user can change
==              other users' passwords over LDAP, including the
==              passwords of administrative users and service
==		accounts.
==
====================================================================

===========
Description
===========

On a Samba 4 AD DC the LDAP server in all versions of Samba from
4.0.0 onwards incorrectly validates permissions to modify passwords
over LDAP allowing authenticated users to change any other users'
passwords, including administrative users and privileged service
accounts (eg Domain Controllers).

The LDAP server incorrectly validates certain LDAP password
modifications against the "Change Password" privilege, but then
performs a password reset operation.

The change password right in AD is an extended object access right
with the GUID ab721a53-1e2f-11d0-9819-00aa0040529b.

By default user objects grant the change password right to the
authenticated user's own user object (self) and to everyone
(world). Computer objects grant the change password right to
everyone.

The corresponding ACEs expressed in SDDL are

self:  (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)
world: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)

The components of these ACEs are

OA: object access allowed
CR: extended rights
PS: trustee: self
WD: trustee: world/everyone

The problematic ACE is the one for world/everyone.

The Windows GUI shows this as "Change password" right granted to
"Everyone".

==========
Workaround
==========

Possible workarounds are described at a dedicated page in the Samba wiki:

https://wiki.samba.org/index.php/CVE-2018-1057

==================
Patch Availability
==================

A patch addressing this defect has been posted to

  https://www.samba.org/samba/security/

Additionally, Samba 4.7.6, 4.6.14 and 4.5.16 have been issued as
security releases to correct the defect. Patches against older Samba
versions may be available at https://samba.org/samba/patches/. Samba
vendors and administrators running affected versions are advised to
upgrade or apply the patch as soon as possible.

=======
Credits
=======

This problem was found by Björn Baumbach from SerNet. Ralph Böhme and
Stefan Metzmacher from SerNet and the Samba Team provided the fix.


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================