Bug 1403115 (CVE-2016-2126)

Summary: CVE-2016-2126 samba: Flaws in Kerberos PAC validation can trigger privilege elevation
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: asn, dankobrin, gdeschner, jrivera, kbost, madam, sbose, security-response-team, sisharma, ssaha, tsorense, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: samba 4.5.3, samba 4.4.8, samba 4.3.13 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:04:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1405356, 1405358, 1405399, 1405984, 1435079, 1437741    
Bug Blocks: 1386080, 1392703, 1415638    

Description Huzaifa S. Sidhpurwala 2016-12-09 05:43:37 UTC
As per upstream:

A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

For the remote attack, the memory overwrite kills the main winbindd process and an authenticated attacker can construct this situation by watching for password changes in Samba.

One specific trigger occurs when winbindd changes its machine account password and the client has still a valid Kerberos ticket (that was encrypted with the old password).

Comment 4 Siddharth Sharma 2016-12-19 12:36:13 UTC
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1405984]

Comment 5 Huzaifa S. Sidhpurwala 2016-12-20 03:21:26 UTC
External Reference:

https://www.samba.org/samba/security/CVE-2016-2126.html

Comment 6 Huzaifa S. Sidhpurwala 2017-01-05 09:35:26 UTC
No mitigation exists for this issue. However, using "machine password timeout = 0" will prevent the bug from being triggered accidentally when the machine password is changed.

Comment 7 Dan 2017-03-01 16:56:56 UTC
I am unable to access any of the related bugs for this to see what is going on. Can someone working this issue post a status update as to having an errata opened for RHEL here?
Thanks

Comment 8 errata-xmlrpc 2017-03-21 10:15:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0662 https://rhn.redhat.com/errata/RHSA-2017-0662.html

Comment 9 errata-xmlrpc 2017-03-21 11:25:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0744 https://rhn.redhat.com/errata/RHSA-2017-0744.html

Comment 10 errata-xmlrpc 2017-03-23 05:12:48 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.2 for RHEL 6

Via RHSA-2017:0494 https://rhn.redhat.com/errata/RHSA-2017-0494.html

Comment 12 errata-xmlrpc 2017-03-23 05:20:37 UTC
This issue has been addressed in the following products:

   	Red Hat Gluster Storage 3.2 for RHEL 7

Via RHSA-2017:0495 https://rhn.redhat.com/errata/RHSA-2017-0495.html

Comment 15 errata-xmlrpc 2017-05-22 10:26:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1265 https://access.redhat.com/errata/RHSA-2017:1265