Bug 1711837 (CVE-2019-12436)

Summary:	CVE-2019-12436 samba: NULL pointer dereference in Samba LDAP server leading to crash and Dos
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abokovoy, anoopcs, asn, dblechte, dfediuck, eedri, gdeschner, jarrpa, jstephen, lmohanty, madam, mgoldboi, michal.skrivanek, rhs-smb, sankarshan, sbonazzo, sbose, security-response-team, sherold, sisharma, ssaha, ssorce, vbellur, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.10.5	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-19 08:06:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1721873
Bug Blocks:	1711838

Description Marian Rehak 2019-05-20 08:30:47 UTC

As per upstream advisory:

A user with read access to the LDAP server can crash the LDAP server process.  Depending on the Samba version and the choice of process model, this may crash only the user's own connection.

Specifically, while in Samba 4.10 the default is for one process per connected client, site-specific configuration trigger can change this.

Samba 4.10 also supports the 'prefork' process model and by using the -M option to 'samba' and a 'single' process model. Both of these share on process between multiple clients.

Comment 1 Riccardo Schirone 2019-05-22 10:38:24 UTC

Mitigation:

Return to the default configuration by running 'samba' with -M standard, however this may consume more memory.

Comment 3 Huzaifa S. Sidhpurwala 2019-06-10 05:07:30 UTC

Acknowledgments:

Name: The samba project (Zombie Ryushu)

Comment 4 Huzaifa S. Sidhpurwala 2019-06-10 06:38:48 UTC

Upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=13951

Comment 6 Huzaifa S. Sidhpurwala 2019-06-19 08:02:26 UTC

External References:

https://www.samba.org/samba/security/CVE-2019-12436.html

Comment 7 Huzaifa S. Sidhpurwala 2019-06-19 08:02:53 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1721873]

Comment 8 Hardik Vyas 2019-06-19 08:10:33 UTC

Statement:

This issue did not affect the version of samba as shipped with 'Red Hat Gluster Storage 3' as they did not include support for Active Directory Domain Controller.