Bug 2222250
| Summary: | The trust relationship between this workstation and the primary domain failed | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | bunkobugsy <admin> | ||||||||
| Component: | samba | Assignee: | Andreas Schneider <asn> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Denis Karpelevich <dkarpele> | ||||||||
| Severity: | high | Docs Contact: | |||||||||
| Priority: | urgent | ||||||||||
| Version: | 7.9 | CC: | aboscatt, asn, atikhono, dkarpele, jwboyer, msugaya, pfilipen, rvdwees, snagar | ||||||||
| Target Milestone: | rc | Keywords: | Regression, Triaged | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | x86_64 | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | samba-4.10.16-25.el7_9 | Doc Type: | If docs needed, set a value | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | |||||||||||
| : | 2222883 2222884 (view as bug list) | Environment: | |||||||||
| Last Closed: | 2023-08-29 09:30:52 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | |||||||||||
| Bug Blocks: | 2222883, 2222884 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
bunkobugsy
2023-07-12 12:09:49 UTC
https://bugzilla.samba.org/show_bug.cgi?id=15418#c3 Actually this might be CVE-2023-21526 Windows Netlogon Information Disclosure Vulnerability For now only solution seems to be removing and blocking KB5028166 (Win10) or KB5028185 (Win11) There’s a patch available that seems to work https://bugzilla.samba.org/show_bug.cgi?id=15418#c25 https://cpaste.org/?df0494cac0063e2e#Cx69G684EBPQ71S6sAUVXSYburgV6gPyKHfPSbfmHZPJ source3/rpc_server/netlogon/srv_netlog_nt.c | 9 +++++---- source4/rpc_server/netlogon/dcerpc_netlogon.c | 8 ++++---- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c index 3ba58e61206f..2018dc28eb67 100644 --- a/source3/rpc_server/netlogon/srv_netlog_nt.c +++ b/source3/rpc_server/netlogon/srv_netlog_nt.c @@ -2284,6 +2284,11 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, struct netlogon_creds_CredentialState *creds; NTSTATUS status; + if (r->in.query_level != 1) { + p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; + return NT_STATUS_NOT_SUPPORTED; + } + become_root(); status = dcesrv_netr_creds_server_step_check(p->dce_call, p->mem_ctx, @@ -2296,10 +2301,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, return status; } - if (r->in.query_level != 1) { - return NT_STATUS_NOT_SUPPORTED; - } - r->out.capabilities->server_capabilities = creds->negotiate_flags; return NT_STATUS_OK; diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c index 6ccba65d3bf0..c869a6d3c791 100644 --- a/source4/rpc_server/netlogon/dcerpc_netlogon.c +++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c @@ -2364,6 +2364,10 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c struct netlogon_creds_CredentialState *creds; NTSTATUS status; + if (r->in.query_level != 1) { + DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); + } + status = dcesrv_netr_creds_server_step_check(dce_call, mem_ctx, r->in.computer_name, @@ -2375,10 +2379,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c } NT_STATUS_NOT_OK_RETURN(status); - if (r->in.query_level != 1) { - return NT_STATUS_NOT_SUPPORTED; - } - r->out.capabilities->server_capabilities = creds->negotiate_flags; return NT_STATUS_OK; Created attachment 1975683 [details]
srv_netlog_nt.patch
srv_netlog_nt.patch for samba-4.10.16-24.el7_9.src.rpm
Created attachment 1975684 [details]
dcerpc_netlogon.patch
dcerpc_netlogon.patch for samba-4.10.16-24.el7_9.src.rpm
Created attachment 1976122 [details]
correct patch built and tested for samba-4.10.16-24.el7_9.src.rpm
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (samba bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:4823 The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |