Bug 1689010 (CVE-2019-3870) - CVE-2019-3870 samba: World writable files in Samba AD DC private/ dir [NEEDINFO]
Summary: CVE-2019-3870 samba: World writable files in Samba AD DC private/ dir
Status: CLOSED NOTABUG
Alias: CVE-2019-3870
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20190409,repor...
Keywords: Security
Depends On: 1697718
Blocks: 1689011
TreeView+ depends on / blocked
 
Reported: 2019-03-14 22:14 UTC by Laura Pardo
Modified: 2019-06-11 11:13 UTC (History)
26 users (show)

(edit)
A vulnerability was found in Samba versions 4.9 and later. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access.  However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.
Clone Of:
(edit)
Last Closed: 2019-06-10 10:50:52 UTC
huzaifas: needinfo? (asn)


Attachments (Terms of Use)

Description Laura Pardo 2019-03-14 22:14:50 UTC
A vulnerability was found in Samba versions 4.9 and later. During the creation of a new Samba AD DC, files are created in a the private/ subdirectory of our install location.  This directory is typically mode 0700, that is owner (root) only access.  However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory files are created with mode 0666, that is world-writable, including a sample krb5.conf and the list of DNS names and servicePrincipalName values to update.

Comment 1 Laura Pardo 2019-03-14 22:14:53 UTC
Acknowledgments:

Name: Björn Baumbach (SerNet)

Comment 3 Doran Moppert 2019-03-19 00:01:14 UTC
Statement:

This issue did not affect the versions of samba as shipped with Red Hat Enterprise Linux or Red Hat Gluster Storage 3 as they did not include support for Active Directory Domain Controller.

Comment 5 Andreas Schneider 2019-04-02 13:20:26 UTC
Looking at the spec file, the pysmbd code is packages in RHEL 7. It is probably not used by anything, but it is there. See

http://pkgs.devel.redhat.com/cgit/rpms/samba/tree/samba.spec?h=rhel-7.6#n2042

Comment 6 Doran Moppert 2019-04-04 03:20:51 UTC
nullIn reply to comment #5:
> Looking at the spec file, the pysmbd code is packages in RHEL 7. It is
> probably not used by anything, but it is there. See
> 
> http://pkgs.devel.redhat.com/cgit/rpms/samba/tree/samba.spec?h=rhel-7.6#n2042

We do build pysmbd, but afaict the affected code belongs to python/samba/provision/ which is packaged as python-dc.  python-dc is only built if %{with_dc} is enabled, which is not presently the case on Red Hat Enterprise Linux.  We'll file a tracker for Fedora when this goes public.

Comment 14 Doran Moppert 2019-04-09 04:05:20 UTC
Created samba tracking bugs for this issue:

Affects: fedora-29 [bug 1697718]


Note You need to log in before you can comment on or make changes to this bug.