===================================================================== CERT-Renater Note d'Information No. 2023/VULN395 _____________________________________________________________________ DATE : 12/10/2023 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Samba versions prior to 4.19.1, 4.18.8, 4.17.12. ===================================================================== https://www.samba.org/samba/security/CVE-2023-3961.html https://www.samba.org/samba/security/CVE-2023-4154.html https://www.samba.org/samba/security/CVE-2023-4091.html https://www.samba.org/samba/security/CVE-2023-42669.html https://www.samba.org/samba/security/CVE-2023-42670.html _____________________________________________________________________ CVE-2023-3961.html: ============================================================ == Subject: smbd allows client access to unix domain sockets == on the file system. == == CVE ID#: CVE-2023-3961 == == Versions: All versions starting with 4.16.0 == == Summary: Unsanitized pipe names allow SMB clients to connect == as root to existing unix domain sockets on the == file system. ============================================================ =========== Description =========== The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ (Inter-Process Communication) share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0, Samba internally connects client pipe names to unix domain sockets within a private directory, allowing clients to connect to services listening on those sockets. This is usually used to connect SMB clients to remote proceedure call (RPC) services, such as SAMR LSA, or SPOOLSS, which Samba starts on demand. However, insufficient sanitization was done on the incoming client pipe name, meaning that a client sending a pipe name containing unix directory traversal characters (../) could cause Samba to connect to unix domain sockets outside of the private directory meant to restrict the services a client could connect to. Samba connects to the unix domain sockets as root, meaning if a client could send a pipe name that resolved to an external service using an existing unix domain socket, the client would be able to connect to it without filesystem permissions restricting access. Depending on the service the client can connect to, the client may be able to trigger adverse events such as denial of service, crashing the service, or potentially compromising it. There are no current known exploits for this bug. ================== Patch Availability ================== Patches addressing this issue have been posted to: https://www.samba.org/samba/security/ Additionally, Samba 4.19.1, 4.18.8 and 4.17.12 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N (6.8) ========== Workaround ========== None. ======= Credits ======= Originally discovered by Jeremy Allison of the Samba team and CIQ. Inc. Patches provided by Jeremy Allison of the Samba team and CIQ. Inc. ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ========================================================== _____________________________________________________________________ CVE-2023-4154.html: =========================================================== == Subject: Samba AD DC password exposure to privileged == users and RODCs == == CVE ID#: CVE-2023-4154 == == Versions: All versions since Samba 4.0.0 == == Summary: An RODC and a user with the GET_CHANGES == right can view all attributes, including == secrets and passwords. == == Additionally, the access check fails open == on error conditions. =========================================================== =========== Description =========== In normal operation, passwords and (most) secrets are never disclosed over LDAP in Active Directory. However, due to a design flaw in Samba's implementation of the DirSync control, Active Directory accounts authorized to do some replication, but not to replicate sensitive attributes, can instead replicate critical domain passwords and secrets. In a default installation, this means that RODC DC accounts (which should only be permitted to replicate some passwords) can instead obtain all domain secrets, including the core AD secret: the krbtgt password. RODCs are given this permission as part of their installation for DRS replication. This vulnerability removes the RODC / DC distinction. Secondly, and just as problematically, the access check for this functionality did not account for error conditions - errors like out of memory were regarded as success. This is sometimes described as "fail open". In these error conditions, some of which (eg out of memory) may be influenced by a low-privileged attacker, access to the secret attributes could be obtained! ================== Patch Availability ================== Patches addressing both these issues have been posted to: https://www.samba.org/samba/security/ Additionally, Samba 4.19.1, 4.18.8 and 4.17.12 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== For password disclosure to RODCs and other privileged accounts: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2) For the fail open on the DirSync access check: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5) ================================= Workaround and mitigating factors ================================= If no RODC accounts are in use in the domain, and DirSync users set LDAP_DIRSYNC_OBJECT_SECURITY then there is no need to give this right to any users. If only privileged accounts have this right, only the error path vulnerability exists. Since Windows 2003 and in all versions of Samba, it has not been required to assign accounts this "Get Changes" / GUID_DRS_GET_CHANGES right to use LDAP DirSync, provided that the LDAP_DIRSYNC_OBJECT_SECURITY it set in the control. If any unprivileged accounts do have this right, and either no longer use DirSync or use LDAP_DIRSYNC_OBJECT_SECURITY, this should be removed. GUID_DRS_GET_CHANGES / 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 is an extended right set in the ntSecurityDescriptor on the NC root (the DN at the top of each partition). These are for example the domain DN, configuration DN etc. The domain DN is the most important. ======= Credits ======= Originally reported by Andrew Bartlett of Catalyst and the Samba Team during routine code review. Patches provided by Andrew Bartlett of Catalyst and the Samba team. ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ========================================================== _____________________________________________________________________ CVE-2023-4091.html: =========================================================== == Subject: SMB clients can truncate files with == read-only permissions == == CVE ID#: CVE-2023-4091 == == Versions: All Samba versions == == Summary: SMB client can truncate files to 0 bytes == by opening files with OVERWRITE disposition == when using the acl_xattr Samba VFS module == with the smb.conf setting == "acl_xattr:ignore system acls = yes" =========================================================== =========== Description =========== The SMB protocol allows opening files where the client requests read-only access, but then implicitly truncating the opened file if the client specifies a separate OVERWRITE create disposition. This operation requires write access to the file, and in the default Samba configuration the operating system kernel will deny access to open a read-only file for read/write (which the truncate operation requires). However, when Samba has been configured to ignore kernel file system permissions, Samba will truncate a file when the underlying operating system kernel would deny the operation. Affected Samba configurations are the ones where kernel file-system permission checks are bypassed, relying on Samba's own permission enforcement. The error is that this check is done against the client request for read-only access, and not the implicitly requested read-write (for truncate) one. The widely used Samba VFS module "acl_xattr" when configured with the module configuration parameter "acl_xattr:ignore system acls = yes" is the only upstream Samba module that allows this behavior and is the only known method of reproducing this security flaw. If (as is the default) the module configuration parameter "acl_xattr:ignore system acls=no", then the Samba server is not vulnerable to this attack. ================== Patch Availability ================== Patches addressing both these issues have been posted to: https://www.samba.org/samba/security/ Additionally, Samba versions 4.19.1, 4.18.8 and 4.17.12 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (6.5) ========== Workaround ========== None. ======= Credits ======= Originally reported by Sri Nagasubramanian from Nasuni. Patches provided by Ralph Böhme of SerNet and the Samba team. ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ========================================================== _____________________________________________________________________ CVE-2023-42669.html: =========================================================== == Subject: "rpcecho" development server allows Denial of Service via sleep() call on AD DC == == CVE ID#: CVE-2023-42669 == == Versions: All versions of Samba since Samba 4.0.0 == == Summary: Calls to the rpcecho server on the AD DC can request that the server block for a user-defined amount of time, denying service. =========================================================== =========== Description =========== Samba developers have built a non-Windows RPC server known as "rpcecho" to test elements of the Samba DCE/RPC stack under their full control. One RPC function provided by "rpcecho" can block, essentially indefinitely, and because the "rpcecho" service is provided from the main RPC task, which has only one worker, this denies essentially all service on the AD DC. To address this problem, the rpcecho server is removed from our production binaries and is restricted to selftest builds only. ================== Patch Availability ================== Patches addressing both these issues have been posted to: https://www.samba.org/samba/security/ Additionally, Samba 4.19.1, 4.18.8 and 4.17.12 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5) ========== Workaround ========== Setting "dcerpc endpoint servers = -rpcecho" will disable the rpcecho service on the AD DC. ======= Credits ======= Originally reported by Andrew Bartlett of Catalyst and the Samba Team. Patches provided by Andrew Bartlett of Catalyst and the Samba Team. Catalyst thanks Planet Innovation for supporting the production of this security fix. ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ========================================================== _____________________________________________________________________ CVE-2023-42670.html: =========================================================== == Subject: Samba AD DC Busy RPC multiple listener DoS == == CVE ID#: CVE-2023-42670 == == Versions: All versions of Samba since Samba 4.16 == == Summary: Samba can be made to start multiple incompatible RPC listeners, disrupting service on the AD DC. =========================================================== =========== Description =========== Samba as an Active Directory DC operates RPC services from two distinct parts of the codebase. Those services focused on the AD DC are started in the main "samba" process, while services focused on the fileserver and NT4-like DC are started from the new samba-dcerpcd, which is launched on-demand from the fileserver (smbd) tasks. When starting, samba-dcerpcd must first confirm which services not to provide, so as to avoid duplicate listeners. The issue in this advisory is that, when Samba's RPC server is under load, or otherwise not responding, the servers NOT built for the AD DC (eg build instead for the NT4-emulation "classic DCs") can be incorrectly started, and compete to listen on the same unix domain sockets. This then results in some queries being answered by the AD DC, and some not. This has been seen in production at multiple sites, as "The procedure number is out of range" when starting Active Directory Users and Computers tool, however it can also be triggered maliciously, to prevent service on the AD DC. ================== Patch Availability ================== Patches addressing both these issues have been posted to: https://www.samba.org/samba/security/ Additionally, Samba 4.19.1, 4.18.8 and 4.17.12 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5) ========== Workaround ========== Setting "rpc start on demand helpers = no" in the smb.conf will disable the file-server based RPC servers entirely. While used less often, these services are required so this is not a long-term solution. ======= Credits ======= Originally reported by Kirin van der Veer of Planet Innovation and diagnosed by Andrew Bartlett of Catalyst and the Samba Team. Patches provided by Andrew Bartlett of Catalyst and the Samba Team. Catalyst thanks Planet Innovation for supporting the production of this security fix. ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ========================================================== ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================