An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.

CVE-2020-1472

**CentOS Errata and Security Advisory** CESA-2020:5439


Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

* samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

* samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

* samba: Unprivileged user can crash winbind (CVE-2020-14323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* The 'require_membership_of' documentation in pam_winbind manpage is incorrect (BZ#1853272)

* Malfunctioning %U substitution in valid users option (BZ#1868917)

* Regression: smbd and nmbd are restarted when samba-winbind package is upgraded (BZ#1878205)

* winbindd memory leak on wbinfo -u with security=ADS (BZ#1892313)

**Merged security bulletin from advisories:**
http://lists.centos.org/pipermail/centos-announce/2020-December/048217.html

**Affected packages:**
ctdb
ctdb-tests
libsmbclient
libsmbclient-devel
libwbclient
libwbclient-devel
samba
samba-client
samba-client-libs
samba-common
samba-common-libs
samba-common-tools
samba-dc
samba-dc-libs
samba-devel
samba-krb5-printing
samba-libs
samba-pidl
samba-python
samba-python-test
samba-test
samba-test-libs
samba-vfs-glusterfs
samba-winbind
samba-winbind-clients
samba-winbind-krb5-locator
samba-winbind-modules

**Upstream details at:**


CentOS Errata and Security Advisory CESA-2020:5439
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.
Security Fix(es):
<ul>
<li>samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)
</li>
<li>samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)
</li>
<li>samba: Unprivileged user can crash winbind (CVE-2020-14323)
</li>
</ul>
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
<ul>
<li>The 'require_membership_of' documentation in pam_winbind manpage is incorrect (BZ#1853272)
</li>
<li>Malfunctioning %U substitution in valid users option (BZ#1868917)
</li>
<li>Regression: smbd and nmbd are restarted when samba-winbind package is upgraded (BZ#1878205)
</li>
<li>winbindd memory leak on wbinfo -u with security=ADS (BZ#1892313)
</li>
</ul>
Merged security bulletin from advisories:
<a href="http://lists.centos.org/pipermail/centos-announce/2020-December/048217.html">http://lists.centos.org/pipermail/centos-announce/2020-December/048217.html</a>
Affected packages:
ctdb
ctdb-tests
libsmbclient
libsmbclient-devel
libwbclient
libwbclient-devel
samba
samba-client
samba-client-libs
samba-common
samba-common-libs
samba-common-tools
samba-dc
samba-dc-libs
samba-devel
samba-krb5-printing
samba-libs
samba-pidl
samba-python
samba-python-test
samba-test
samba-test-libs
samba-vfs-glusterfs
samba-winbind
samba-winbind-clients
samba-winbind-krb5-locator
samba-winbind-modules
Upstream details at:

Centos

ctdb, libsmbclient, libwbclient, samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

* samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

* samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

* samba: Unprivileged user can crash winbind (CVE-2020-14323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* The 'require_membership_of' documentation in pam_winbind manpage is incorrect (BZ#1853272)

* Malfunctioning %U substitution in valid users option (BZ#1868917)

* Regression: smbd and nmbd are restarted when samba-winbind package is upgraded (BZ#1878205)

* winbindd memory leak on wbinfo -u with security=ADS (BZ#1892313)

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.
Security Fix(es):
<ul>
<li>samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)
</li>
<li>samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)
</li>
<li>samba: Unprivileged user can crash winbind (CVE-2020-14323)
</li>
</ul>
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
<ul>
<li>The 'require_membership_of' documentation in pam_winbind manpage is incorrect (BZ#1853272)
</li>
<li>Malfunctioning %U substitution in valid users option (BZ#1868917)
</li>
<li>Regression: smbd and nmbd are restarted when samba-winbind package is upgraded (BZ#1878205)
</li>
<li>winbindd memory leak on wbinfo -u with security=ADS (BZ#1892313)
</li>
</ul>

Redhat

(RHSA-2020:5439) Moderate: samba security and bug fix update

-------------------------------------------------------------------------
Debian LTS Advisory DLA-2463-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                  Roberto C. Sánchez
November 22, 2020                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : samba
Version        : 2:4.5.16+dfsg-1+deb9u3
CVE ID         : CVE-2020-1472 CVE-2020-10704 CVE-2020-10730 CVE-2020-10745 
                 CVE-2020-10760 CVE-2020-14303 CVE-2020-14318 CVE-2020-14323 
                 CVE-2020-14383

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix.

CVE-2020-1472

    Unauthenticated domain controller compromise by subverting Netlogon
    cryptography.  This vulnerability includes both ZeroLogon and
    non-ZeroLogon variations.

CVE-2020-10704

    An unauthorized user can trigger a denial of service via a stack
    overflow in the AD DC LDAP server.

CVE-2020-10730

    NULL pointer de-reference and use-after-free in Samba AD DC LDAP
    Server with ASQ, VLV and paged_results.

CVE-2020-10745

    Denial of service resulting from abuse of compression of replies to
    NetBIOS over TCP/IP name resolution and DNS packets causing excessive
    CPU load on the Samba AD DC.

CVE-2020-10760

    The use of the paged_results or VLV controls against the Global
    Catalog LDAP server on the AD DC will cause a use-after-free.

CVE-2020-14303

    Denial of service resulting from CPU spin and and inability to
    process further requests once the AD DC NBT server receives an empty
    (zero-length) UDP packet to port 137.

CVE-2020-14318

    Missing handle permissions check in ChangeNotify

CVE-2020-14323

    Unprivileged user can crash winbind via invalid lookupsids DoS

CVE-2020-14383

    DNS server crash via invalid records resulting from uninitialized
    variables

For Debian 9 stretch, these problems have been fixed in version
2:4.5.16+dfsg-1+deb9u3.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/samba

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


<hr />
Debian LTS Advisory DLA-2463-1 <a href="mailto:debian-lts@lists.debian.org">debian-lts@lists.debian.org</a>
<a href="https://www.debian.org/lts/security/">https://www.debian.org/lts/security/</a> Roberto C. Sánchez
November 22, 2020 <a href="https://wiki.debian.org/LTS">https://wiki.debian.org/LTS</a>
<hr />
Package : samba
Version : 2:4.5.16+dfsg-1+deb9u3
CVE ID : CVE-2020-1472 CVE-2020-10704 CVE-2020-10730 CVE-2020-10745 
 CVE-2020-10760 CVE-2020-14303 CVE-2020-14318 CVE-2020-14323 
 CVE-2020-14383
Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix.
CVE-2020-1472
<pre><code>Unauthenticated domain controller compromise by subverting Netlogon
cryptography. This vulnerability includes both ZeroLogon and
non-ZeroLogon variations.</code></pre>
CVE-2020-10704
<pre><code>An unauthorized user can trigger a denial of service via a stack
overflow in the AD DC LDAP server.</code></pre>
CVE-2020-10730
<pre><code>NULL pointer de-reference and use-after-free in Samba AD DC LDAP
Server with ASQ, VLV and paged_results.</code></pre>
CVE-2020-10745
<pre><code>Denial of service resulting from abuse of compression of replies to
NetBIOS over TCP/IP name resolution and DNS packets causing excessive
CPU load on the Samba AD DC.</code></pre>
CVE-2020-10760
<pre><code>The use of the paged_results or VLV controls against the Global
Catalog LDAP server on the AD DC will cause a use-after-free.</code></pre>
CVE-2020-14303
<pre><code>Denial of service resulting from CPU spin and and inability to
process further requests once the AD DC NBT server receives an empty
(zero-length) UDP packet to port 137.</code></pre>
CVE-2020-14318
<pre><code>Missing handle permissions check in ChangeNotify</code></pre>
CVE-2020-14323
<pre><code>Unprivileged user can crash winbind via invalid lookupsids DoS</code></pre>
CVE-2020-14383
<pre><code>DNS server crash via invalid records resulting from uninitialized
variables</code></pre>
For Debian 9 stretch, these problems have been fixed in version
2:4.5.16+dfsg-1+deb9u3.
We recommend that you upgrade your samba packages.
For the detailed security status of samba please refer to
its security tracker page at:
<a href="https://security-tracker.debian.org/tracker/samba">https://security-tracker.debian.org/tracker/samba</a>
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: <a href="https://wiki.debian.org/LTS">https://wiki.debian.org/LTS</a>

Debian

[SECURITY] [DLA 2463-1] samba security update

Tom Tervoort discovered that the Netlogon protocol implemented by Samba  
incorrectly handled the authentication scheme. A remote attacker could use  
this issue to forge an authentication token and steal the credentials of  
the domain admin.

While a previous security update fixed the issue by changing the "server  
schannel" setting to default to "yes", instead of "auto", which forced a  
secure netlogon channel, this update provides additional improvements.

For compatibility reasons with older devices, Samba now allows specifying  
an insecure netlogon configuration per machine. See the following link for  
examples: 

In addition, this update adds additional server checks for the protocol  
attack in the client-specified challenge to provide some protection when  
'server schannel = no/auto' and avoid the false-positive results when  
running the proof-of-concept exploit.

Tom Tervoort discovered that the Netlogon protocol implemented by Samba incorrectly handled the authentication scheme. A remote attacker could use this issue to forge an authentication token and steal the credentials of the domain admin.
While a previous security update fixed the issue by changing the "server schannel" setting to default to "yes", instead of "auto", which forced a secure netlogon channel, this update provides additional improvements.
For compatibility reasons with older devices, Samba now allows specifying an insecure netlogon configuration per machine. See the following link for examples: 
In addition, this update adds additional server checks for the protocol attack in the client-specified challenge to provide some protection when 'server schannel = no/auto' and avoid the false-positive results when running the proof-of-concept exploit.

Ubuntu

Samba update

USN-4510-1 fixed a vulnerability in Samba. This update provides  
the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Tom Tervoort discovered that the Netlogon protocol implemented by Samba  
incorrectly handled the authentication scheme. A remote attacker could use  
this issue to forge an authentication token and steal the credentials of  
the domain admin.

This update fixes the issue by changing the "server schannel" setting to  
default to "yes", instead of "auto", which will force a secure netlogon  
channel. This may result in compatibility issues with older devices. A  
future update may allow a finer-grained control over this setting.

USN-4510-1 fixed a vulnerability in Samba. This update provides the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Tom Tervoort discovered that the Netlogon protocol implemented by Samba incorrectly handled the authentication scheme. A remote attacker could use this issue to forge an authentication token and steal the credentials of the domain admin.
This update fixes the issue by changing the "server schannel" setting to default to "yes", instead of "auto", which will force a secure netlogon channel. This may result in compatibility issues with older devices. A future update may allow a finer-grained control over this setting.

Samba vulnerability

Tom Tervoort discovered that the Netlogon protocol implemented by Samba  
incorrectly handled the authentication scheme. A remote attacker could use  
this issue to forge an authentication token and steal the credentials of  
the domain admin.

This update fixes the issue by changing the "server schannel" setting to  
default to "yes", instead of "auto", which will force a secure netlogon  
channel. This may result in compatibility issues with older devices. A  
future update may allow a finer-grained control over this setting.

Tom Tervoort discovered that the Netlogon protocol implemented by Samba incorrectly handled the authentication scheme. A remote attacker could use this issue to forge an authentication token and steal the credentials of the domain admin.
This update fixes the issue by changing the "server schannel" setting to default to "yes", instead of "auto", which will force a secure netlogon channel. This may result in compatibility issues with older devices. A future update may allow a finer-grained control over this setting.

Featured CVEs

Feed of the featured CVEs from Vulcan Remedy Cloud.

Vulcan Remedy Cloud - Featured CVEs

Thank you for downloading from Remedy Cloud!

Please fill out the form to download the CSV

Your Script is On It's Way!

Tell us where to send the script

Your Email Was Successfully Sent!

Email

Your Name

Your fix has been sent successfully!

Suggest a Fix

Search for a CVE below to see all the available fixes

Remedy Cloud

Loading - Vulcan Remedy Cloud

The page you are looking for was moved, removed, renamed or might never existed.

CVE-2020-1472

22 fixes found:

Version Update

ctdb, libsmbclient, libwbclient, samba security update

Version Update

(RHSA-2020:5439) Moderate: samba security and bug fix update

Version Update

[SECURITY] [DLA 2463-1] samba security update

Version Update

Samba update

Version Update

Samba update

Version Update

Samba update

Version Update

Samba vulnerability

Version Update

Samba vulnerability