LWN: Comments on "Samba 4.15.2, 4.14.10, 4.13.14 security releases available"

Samba 4.15.2, 4.14.10, 4.13.14 security releases apply to AD domain scenerios only

abartlet — Mon, 15 Nov 2021 07:31:34 +0000

Firstly, sorry for missing the CVSS score on CVE-2016-2124. My stab at this is:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (5.3)

(CVSS scores are meant to assume the worst case)

It isn't ideal that it is possible to disclose the NTLMv2 response, due to 'pass the hash' attacks, but by default the plaintext password isn't shown unless other configuration options were set (client plaintext auth). That would make it a 3.1 if you consider an NTLMv2 response a 'limited breach of confidentiality'.

More broadly, there are a few concerns for Samba clients in Windows domains. It depends on what kind of client and what level of trust there is in the DC, but we issued CVE-2020-25717 because the controls around msDS-MachineAccountQuota were way to weak (and Samba was not strict enough about sandboxing AD accounts to an AD-specific namespace).

My personal view is that CVE-2021-23192 was important to fix but it is a server-side issue and assumes a MITM already and a request with multiple fragments (which is rare, and quite unlikely outside the context of being the DC).

Samba 4.15.2, 4.14.10, 4.13.14 security releases apply to AD domain scenerios only

docontra — Sun, 14 Nov 2021 12:38:41 +0000

From reading the security advisories, Samba clients joined to AD may be vulnerable to CVE-2016-2124 (IIUC, it's the protocol vulnerability that caused Microsoft to disable SMB1 by default in later Windows 10 releases; requires specific client configuration to trigger), CVE-2020-25717 (second highest CVSSv3 rating, but some vulnerabilities were not rated) and CVE-2021-23192 (lowest CVSSv3 rated vulnerability).

Samba 4.15.2, 4.14.10, 4.13.14 security releases apply to AD domain scenerios only

pabs — Sun, 14 Nov 2021 07:03:52 +0000

What about Samba based clients of a Windows based AD domain and DC?

Samba 4.15.2, 4.14.10, 4.13.14 security releases apply to AD domain scenerios only

abartlet — Fri, 12 Nov 2021 20:21:19 +0000

To be clear, the situations that are a worry here are those servers in an AD domain or which are an AD DC. A standalone fileserver in particular is not the concern here.

Samba 4.15.2, 4.14.10, 4.13.14 security releases available

ccchips — Thu, 11 Nov 2021 22:56:06 +0000

Updated to 4.13.14.

Thank you!

Samba 4.15.2, 4.14.10, 4.13.14 security releases available

ccchips — Wed, 10 Nov 2021 18:25:28 +0000

Linux Mint 20.2 is showing 4.11.6. Can anyone advise me how I can request this be upgraded, or is it even possible?