Bug 1403115 (CVE-2016-2126) - CVE-2016-2126 samba: Flaws in Kerberos PAC validation can trigger privilege elevation
Summary: CVE-2016-2126 samba: Flaws in Kerberos PAC validation can trigger privilege e...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-2126
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20161219,repor...
Depends On: 1405356 1405358 1405399 1405984 1435079 1437741
Blocks: 1386080 1392703 1415638
TreeView+ depends on / blocked
 
Reported: 2016-12-09 05:43 UTC by Huzaifa S. Sidhpurwala
Modified: 2019-06-11 11:13 UTC (History)
12 users (show)

Fixed In Version: samba 4.5.3, samba 4.4.8, samba 4.3.13
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:04:06 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0494 normal SHIPPED_LIVE Moderate: Red Hat Gluster Storage 3.2.0 samba security, bug fixes and enhancement update 2017-03-23 09:06:59 UTC
Red Hat Product Errata RHSA-2017:0495 normal SHIPPED_LIVE Moderate: Red Hat Gluster Storage 3.2.0 samba security, bug fixes and enhancement update 2017-03-23 09:18:26 UTC
Red Hat Product Errata RHSA-2017:0662 normal SHIPPED_LIVE Moderate: samba security and bug fix update 2017-03-21 12:34:11 UTC
Red Hat Product Errata RHSA-2017:0744 normal SHIPPED_LIVE Moderate: samba4 security and bug fix update 2017-03-21 12:44:53 UTC
Red Hat Product Errata RHSA-2017:1265 normal SHIPPED_LIVE Moderate: samba security and bug fix update 2017-05-22 14:25:41 UTC

Description Huzaifa S. Sidhpurwala 2016-12-09 05:43:37 UTC
As per upstream:

A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

For the remote attack, the memory overwrite kills the main winbindd process and an authenticated attacker can construct this situation by watching for password changes in Samba.

One specific trigger occurs when winbindd changes its machine account password and the client has still a valid Kerberos ticket (that was encrypted with the old password).

Comment 4 Siddharth Sharma 2016-12-19 12:36:13 UTC
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1405984]

Comment 5 Huzaifa S. Sidhpurwala 2016-12-20 03:21:26 UTC
External Reference:

https://www.samba.org/samba/security/CVE-2016-2126.html

Comment 6 Huzaifa S. Sidhpurwala 2017-01-05 09:35:26 UTC
No mitigation exists for this issue. However, using "machine password timeout = 0" will prevent the bug from being triggered accidentally when the machine password is changed.

Comment 7 Dan 2017-03-01 16:56:56 UTC
I am unable to access any of the related bugs for this to see what is going on. Can someone working this issue post a status update as to having an errata opened for RHEL here?
Thanks

Comment 8 errata-xmlrpc 2017-03-21 10:15:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0662 https://rhn.redhat.com/errata/RHSA-2017-0662.html

Comment 9 errata-xmlrpc 2017-03-21 11:25:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0744 https://rhn.redhat.com/errata/RHSA-2017-0744.html

Comment 10 errata-xmlrpc 2017-03-23 05:12:48 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.2 for RHEL 6

Via RHSA-2017:0494 https://rhn.redhat.com/errata/RHSA-2017-0494.html

Comment 12 errata-xmlrpc 2017-03-23 05:20:37 UTC
This issue has been addressed in the following products:

   	Red Hat Gluster Storage 3.2 for RHEL 7

Via RHSA-2017:0495 https://rhn.redhat.com/errata/RHSA-2017-0495.html

Comment 15 errata-xmlrpc 2017-05-22 10:26:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1265 https://access.redhat.com/errata/RHSA-2017:1265


Note You need to log in before you can comment on or make changes to this bug.