Bug 1491206 (CVE-2017-12163)

Summary:	CVE-2017-12163 Samba: Server memory information leak over SMB1
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abokovoy, anoopcs, asn, gdeschner, jarrpa, jlayton, lmohanty, madam, rhs-smb, sbose, security-response-team, sisharma, ssaha, ssorce, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:25:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1491209, 1491210, 1491211, 1491212, 1491213, 1491214, 1491769, 1493441
Bug Blocks:	1488198

Description Huzaifa S. Sidhpurwala 2017-09-13 10:28:51 UTC

All versions of Samba are vulnerable to a server memory information leak bug over SMB1 if a client can write data to a share. Some SMB1 write requests were not correctly range checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client supplied data. The client cannot control the area of the server memory that is written to the file (or printer).

Comment 1 Huzaifa S. Sidhpurwala 2017-09-13 10:29:00 UTC

Mitigation:

As this is an SMB1-only vulnerability, it can be avoided by setting the server to only use SMB2 via adding:

server min protocol = SMB2_02

to the [global] section of your smb.conf and restarting smbd.

Comment 2 Huzaifa S. Sidhpurwala 2017-09-13 10:29:06 UTC

Acknowledgments:

Name: Yihan Lian and Zhibin Hu (Qihoo 360 Gear Team), Stefan Metzmacher (SerNet), Jeremy Allison (Google)

Comment 5 Huzaifa S. Sidhpurwala 2017-09-20 08:19:08 UTC

External References:

https://www.samba.org/samba/security/CVE-2017-12163.html

Comment 6 Huzaifa S. Sidhpurwala 2017-09-20 08:21:25 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1493441]

Comment 7 errata-xmlrpc 2017-09-21 11:51:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:2791 https://access.redhat.com/errata/RHSA-2017:2791

Comment 8 errata-xmlrpc 2017-09-21 14:07:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2790 https://access.redhat.com/errata/RHSA-2017:2790

Comment 9 errata-xmlrpc 2017-09-21 14:19:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:2789 https://access.redhat.com/errata/RHSA-2017:2789

Comment 10 errata-xmlrpc 2017-10-04 05:14:00 UTC

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.3 for RHEL 6
  Red Hat Gluster Storage 3.3 for RHEL 7

Via RHSA-2017:2858 https://access.redhat.com/errata/RHSA-2017:2858