Bug 1764126 (CVE-2019-14833) - CVE-2019-14833 samba: AD DC check password script does not receive full password when non-ASCII characters are used
Summary: CVE-2019-14833 samba: AD DC check password script does not receive full passw...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-14833
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1766559
Blocks: 1763144
TreeView+ depends on / blocked
 
Reported: 2019-10-22 09:54 UTC by Siddharth Sharma
Modified: 2021-02-16 21:12 UTC (History)
26 users (show)

Fixed In Version: samba 4.9.15, samba 4.10.10, samba 4.11.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Samba in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.
Clone Of:
Environment:
Last Closed: 2019-11-04 18:51:12 UTC
Embargoed:

Attachments (Terms of Use)

Description Siddharth Sharma 2019-10-22 09:54:46 UTC 
A flaw was found in Samba in the way it handles user password change or new password for samba user. Samba AD DC can be configured to use custom script to check for password complexity which can fail to verify password complexity when non-ASCII characters are used in password which could lead to weak passwords being set for samba users making it vulnerable to dictionary attacks.

Upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=12438
Comment 1 Huzaifa S. Sidhpurwala 2019-10-23 05:58:57 UTC 
Statement:

This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux because there is no support for samba as Active Directory Domain Controller.
Comment 2 Huzaifa S. Sidhpurwala 2019-10-23 05:59:01 UTC 
Mitigation:

If the check password script parameter is not specified, Samba runs the internal password quality checks. The internal check makes sure that a password contains characters from three of five different characters categories.
Comment 6 Huzaifa S. Sidhpurwala 2019-10-23 11:32:41 UTC 
Acknowledgments:

Name: the Samba project
Upstream: Simon Fonteneau
Comment 7 Siddharth Sharma 2019-10-29 11:38:20 UTC 
External References:

https://www.samba.org/samba/security/CVE-2019-14833.html
Comment 8 Siddharth Sharma 2019-10-29 11:38:37 UTC 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1766559]
Comment 9 Product Security DevOps Team 2019-11-04 18:51:12 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14833
Note You need to log in before you can comment on or make changes to this bug.