Bug 1403115 (CVE-2016-2126) - CVE-2016-2126 samba: Flaws in Kerberos PAC validation can trigger privilege elevation
Summary: CVE-2016-2126 samba: Flaws in Kerberos PAC validation can trigger privilege e...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-2126
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1405356 1405358 1405399 1405984 1435079 1437741
Blocks: 1386080 1392703 1415638
TreeView+ depends on / blocked
 
Reported: 2016-12-09 05:43 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-17 02:54 UTC (History)
12 users (show)

Fixed In Version: samba 4.5.3, samba 4.4.8, samba 4.3.13
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:04:06 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0494 0 normal SHIPPED_LIVE Moderate: Red Hat Gluster Storage 3.2.0 samba security, bug fixes and enhancement update 2017-03-23 09:06:59 UTC
Red Hat Product Errata RHSA-2017:0495 0 normal SHIPPED_LIVE Moderate: Red Hat Gluster Storage 3.2.0 samba security, bug fixes and enhancement update 2017-03-23 09:18:26 UTC
Red Hat Product Errata RHSA-2017:0662 0 normal SHIPPED_LIVE Moderate: samba security and bug fix update 2017-03-21 12:34:11 UTC
Red Hat Product Errata RHSA-2017:0744 0 normal SHIPPED_LIVE Moderate: samba4 security and bug fix update 2017-03-21 12:44:53 UTC
Red Hat Product Errata RHSA-2017:1265 0 normal SHIPPED_LIVE Moderate: samba security and bug fix update 2017-05-22 14:25:41 UTC

Description Huzaifa S. Sidhpurwala 2016-12-09 05:43:37 UTC 
As per upstream:

A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

For the remote attack, the memory overwrite kills the main winbindd process and an authenticated attacker can construct this situation by watching for password changes in Samba.

One specific trigger occurs when winbindd changes its machine account password and the client has still a valid Kerberos ticket (that was encrypted with the old password).
Comment 4 Siddharth Sharma 2016-12-19 12:36:13 UTC 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1405984]
Comment 5 Huzaifa S. Sidhpurwala 2016-12-20 03:21:26 UTC 
External Reference:

https://www.samba.org/samba/security/CVE-2016-2126.html
Comment 6 Huzaifa S. Sidhpurwala 2017-01-05 09:35:26 UTC 
No mitigation exists for this issue. However, using "machine password timeout = 0" will prevent the bug from being triggered accidentally when the machine password is changed.
Comment 7 Dan 2017-03-01 16:56:56 UTC 
I am unable to access any of the related bugs for this to see what is going on. Can someone working this issue post a status update as to having an errata opened for RHEL here?
Thanks
Comment 8 errata-xmlrpc 2017-03-21 10:15:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0662 https://rhn.redhat.com/errata/RHSA-2017-0662.html
Comment 9 errata-xmlrpc 2017-03-21 11:25:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0744 https://rhn.redhat.com/errata/RHSA-2017-0744.html
Comment 10 errata-xmlrpc 2017-03-23 05:12:48 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.2 for RHEL 6

Via RHSA-2017:0494 https://rhn.redhat.com/errata/RHSA-2017-0494.html
Comment 12 errata-xmlrpc 2017-03-23 05:20:37 UTC 
This issue has been addressed in the following products:

   	Red Hat Gluster Storage 3.2 for RHEL 7

Via RHSA-2017:0495 https://rhn.redhat.com/errata/RHSA-2017-0495.html
Comment 15 errata-xmlrpc 2017-05-22 10:26:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1265 https://access.redhat.com/errata/RHSA-2017:1265
Note You need to log in before you can comment on or make changes to this bug.