Bug 1764126 (CVE-2019-14833)

Summary:	CVE-2019-14833 samba: AD DC check password script does not receive full password when non-ASCII characters are used
Product:	[Other] Security Response	Reporter:	Siddharth Sharma <sisharma>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abokovoy, anoopcs, asn, dblechte, dfediuck, eedri, gdeschner, hvyas, iboukris, iboukris, jarrpa, jstephen, lmohanty, madam, mgoldboi, michal.skrivanek, puebele, rhs-smb, sbonazzo, sbose, security-response-team, sherold, sisharma, ssorce, vbellur, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.9.15, samba 4.10.10, samba 4.11.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Samba in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-04 18:51:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1766559
Bug Blocks:	1763144

Description Siddharth Sharma 2019-10-22 09:54:46 UTC

A flaw was found in Samba in the way it handles user password change or new password for samba user. Samba AD DC can be configured to use custom script to check for password complexity which can fail to verify password complexity when non-ASCII characters are used in password which could lead to weak passwords being set for samba users making it vulnerable to dictionary attacks.

Upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=12438

Comment 1 Huzaifa S. Sidhpurwala 2019-10-23 05:58:57 UTC

Statement:

This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux because there is no support for samba as Active Directory Domain Controller.

Comment 2 Huzaifa S. Sidhpurwala 2019-10-23 05:59:01 UTC

Mitigation:

If the check password script parameter is not specified, Samba runs the internal password quality checks. The internal check makes sure that a password contains characters from three of five different characters categories.

Comment 6 Huzaifa S. Sidhpurwala 2019-10-23 11:32:41 UTC

Acknowledgments:

Name: the Samba project
Upstream: Simon Fonteneau

Comment 7 Siddharth Sharma 2019-10-29 11:38:20 UTC

External References:

https://www.samba.org/samba/security/CVE-2019-14833.html

Comment 8 Siddharth Sharma 2019-10-29 11:38:37 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1766559]

Comment 9 Product Security DevOps Team 2019-11-04 18:51:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14833