The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.

As per upstream samba advisory:

All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon.

A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges.

Heap-based buffer overflow in the dcerpcreadncacnpacketdone function in librpc/rpc/dcerpcutil.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

As per upstream samba advisory:

All versions of Samba from 3.6.0 onwards are vulnerable to a heap memory information leak, where server allocated heap memory may be returned to the client without being cleared.

There is no known vulnerability associated with this error, but uncleared heap memory may contain previously used data that may help an attacker compromise the server via other methods. Uncleared heap memory may potentially contain password hashes or other high-value data.

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.

The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.

Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacnnp, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSPNEGOTIATESEAL or NTLMSSPNEGOTIATESIGN option to disrupt LDAP security.

Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.

The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.

Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests.

A race condition was found in the way 'mount.cifs' and 'umount.cifs' utilities performed mount / umount of a particular CIFS share to / from specified mount point (/etc/mtab~ lockfile was created before updating the /etc/mtab file and deleted once the operation completed), when these utilies were setuid root enabled. A local attacker could use this flaw to conduct denial of service attacks (failure of subsequent CIFS share umount / mount requests) by sending termination signal to 'mount.cifs' / 'umount.cifs' processes in the moment of existence of a stale (/etc/mtab~) lockfile.

References: [1] https://bugzilla.samba.org/showbug.cgi?id=7179 (upstream bug report) [2] http://git.samba.org/?p=cifs-utils.git;a=commitdiff;h=810f7e4e0f2dbcbee0294d9b371071cb08268200 (upstream patch) [3] http://www.openwall.com/lists/oss-security/2011/09/27/1 (CVE request) [4] http://www.openwall.com/lists/oss-security/2011/09/30/5 (CVE assignment)

Note: This flaw to be exploitable as described above requires the 'mount.cifs' / 'umount.cifs' utilities to be setuid root enabled. These utilities are not setuid root enabled on Red Hat Enterprise Linux and Fedora distributions, and thus these distributions as such are not vulnerable to this flaw.

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-0454 to the following vulnerability:

Name: CVE-2013-0454 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0454 Assigned: 20121216 Reference: https://lists.samba.org/archive/samba-announce/2012/000259.html Reference: https://bugzilla.samba.org/showbug.cgi?id=8738 Reference: http://www.ibm.com/support/docview.wss?uid=ssg1S1004289 Reference: http://xforce.iss.net/xforce/xfdb/80970

Samba before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) triggerdata-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.

Created attachment 895515 [details] Strace of nmbd when the problem is triggered

Description of problem:

I'm running samba3x (samba3x-3.6.6-0.139.el510) as an simple NT domain controler on a CentOS 5.10, and found sometime the nmbd process stuck (eating 100% CPU, and not responding anymore to any request, making any domain login impossible). The only solution was to kill -9 this process and restart it. It was occuring randomly, so was quite hard to troubleshoot, but after a few hours, I've finaly identified what's causing it (well at least, I know a simple request from a client is enough to trigger it)

I'll attach:

- a strace of the process at the time the problem occure. In this file the last lines (recvfrom(12, 0xbfcff9c8, 576, 0, 0xbfcffc08, 0xbfcff988) = -1 EAGAIN (Resource temporarily unavailable)) is repeated indefinitly as long as the process isn't killed, producing several GB per hour in the strace file. I've truncated it to the interesting part

- a pcap of the packet crashing nmbd (which you can replay with tcpreplay to reproduce the issue)

Version-Release number of selected component (if applicable):

How reproducible: 100% with the attached pcap

Steps to Reproduce: 1. You need a client with IP 192.168.7.50 and MAC 6c:62:6d:b0:25:42 2. The server running nmbd with IP 192.168.7.1 and MAC 52:54:00:7C:31:C4 (if you have different values you'll have to tweak the pcap with tcprewrite) 3. The netbios name of the samba server should be SAS (it's contained in the pcap and needs to match the netbios name of the server in order to trigger the issue) 4. Run nmbd (I'm running it with daemontools with /usr/sbin/nmbd -F -S but that probably doesn't matter) 5. Replay the attached pcap with tcpreplay -i eth0 nmbddos.pcap

Actual results: nmbd will go in a loop, taking 100% of a core, and won't respond to any further requests, making impossible to login on the domain

Expected results: nmbd should continue working as normal

Additional info:

Marking this a security issue as it makes it very easy to DOS a domain controler

It was discovered that smbd, the Samba file server deamon, did not properly handle certain valid on-disk unicode path names if an authenticated client tries to read them via a non-unicode request.

In case the pushascii() function encounters an error, e.g. a conversion failure, its error return value may incorrectly be used as a pointer in subsequent memory writes, leading to a crash or possible memory corruption.

Acknowledgments:

Red Hat would like to thank the Samba project for reporting this issue. The Samba project acknowledges Simon Arlott as the original reporter.