SB2018052308 - Gentoo update for Samba

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2016-2119)

The vulnerability allows a remote attacker to downgrade client signing security controls on the target system.

The vulnerability exists due to state error in Samba. A remote unauthenticated attacker can downgrade the required signing for an SMB2/3 client connection by injecting the SMB2_SESSION_FLAG_IS_GUEST or SMB2_SESSION_FLAG_IS_NULL flags.

Successful exploitation of this vulnerability may result in disclosure of system information.

2) Use-after-free (CVE-ID: CVE-2017-14746)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error when processing SMB1 requests. A remote attacker can send a specially crafted SMB1 request to vulnerable server, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable SMB server.

3) Memory leak (CVE-ID: CVE-2017-15275)

The vulnerability allows a remote attacker to access potentially sensitive information.

The vulnerability exists due to uncleared heap memory is sent to the client. A remote attacker can obtain potentially sensitive information and use it in further attacks.

4) Insecure library loading (CVE-ID: CVE-2017-7494)

The vulnerability allows a remote authenticated attacker to execute arbitrary code on vulnerable server.

The vulnerability exists due to insecure library loading mechanism, when processing files on file shares. A remote attacker with ability to upload file on SMB share can upload and execute arbitrary shared library on the server with privileges of the Samba process.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

5) Improper input validation (CVE-ID: CVE-2018-1050)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when processing RPC requests to the spoolss service. A remote attacker can send a specially crafted RPC request to the affected service and trigger denial of service conditions.

Successful exploitation of the vulnerability requires that the RPC spoolss service services is configured as external daemon.

6) Improper access control (CVE-ID: CVE-2018-1057)

The vulnerability allows a remote attacker to change password of arbitrary user on the server.

The vulnerability exists due to insufficient validation of user rights when changing passwords. An authenticated attacker can send a specially crated LDAP request to the directory server and change password of arbitrary AD user, including administrative accounts.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/glsa/201805-07