Bug 1610645 (CVE-2018-10919)

Summary:	CVE-2018-10919 samba: Confidential attribute disclosure via substring search
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, abokovoy, anoopcs, asn, bmcclain, dbaker, dblechte, dfediuck, eedri, gdeschner, jarrpa, jokerman, jstephen, lmohanty, madam, mgoldboi, michal.skrivanek, rhs-smb, sankarshan, sbonazzo, sbose, security-response-team, sherold, sisharma, ssaha, ssorce, sthangav, trankin, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.6.16, samba 4.7.9, samba 4.8.4	Doc Type:	If docs needed, set a value
Doc Text:	The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-12 13:05:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1612808, 1617911, 1617914, 1618620, 1618621
Bug Blocks:	1610646

Description Sam Fowler 2018-08-01 05:34:54 UTC

When using custom LDAP attributes, Samba seems to recognize the searchFlags confidential flag on custom attributes and hides them from all non-admin users. However, the values of the attributes can still be guessed efficiently by brute forcing them one character after another in a wildcard search query.

Comment 2 Sam Fowler 2018-08-16 03:41:43 UTC

External Reference:

https://www.samba.org/samba/security/CVE-2018-10919.html

Comment 3 Sam Fowler 2018-08-16 07:13:27 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1617911]

Comment 5 Huzaifa S. Sidhpurwala 2018-08-17 05:49:06 UTC

Acknowledgments:

Name: Phillip Kuhrt (the Samba project)

Comment 8 Product Security DevOps Team 2019-07-12 13:05:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-10919