Bugzilla – Bug 1160888
VUL-0: CVE-2019-14907: samba: server-side crash after charset conversion failure (eg during NTLMSSP processing)
Last modified: 2020-09-17 19:15:15 UTC
CRD: 2020-01-21
Just a quick question regarding SLE12 and submission for this bug iiuc we don't need to submit this for SLE12-SP0/SP1/SP2/SP3 (as they are out of general support) I am assuming submissions are only needed then for SLE12-SP4 & SLE12-SP5 if that is correct then currently SLE12-SP4 inherits samba from SLE12-SP3 so I just want clarify which SLE12-SP projects to submit too (e.g. for SP4 just submit to SP3 is enough?) and just to confirm we don't need SP0/SP1/SP2/SP3 unless specifically requested
SLES 12 SP4 inherits from SLES 12 SP3, so you would submit to SLES 12 SP3 for SP3+SP4 shipment. SLES 12 SP5 has also samba sources at samba-4.10.5+git.129.35f7bb6e177.tar.bz2
is public https://www.samba.org/samba/security/CVE-2019-14907.html CVE-2019-14907.html =========================================================== == Subject: Crash after failed character conversion at == log level 3 or above == == CVE ID#: CVE-2019-14907 == == Versions: Samba 4.0 and later versions == == Summary: When processing untrusted string input Samba == can read past the end of the allocated buffer == when printing a "Conversion error" message == to the logs. == =========================================================== =========== Description =========== If samba is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process (such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless). ================== Patch Availability ================== Patches addressing both these issues have been posted to: https://www.samba.org/samba/security/ Additionally, Samba 4.11.5, 4.10.12 and 4.9.18 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5) ========== Workaround ========== Do not set a log level of 3 or above in production. ======= Credits ======= Originally reported by Robert Święcki using a fuzzer he wrote. Patches provided by Andrew Bartlett of the Samba team and Catalyst. ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ==========================================================
SUSE-SU-2020:0152-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1160888 CVE References: CVE-2019-14907 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): samba-4.10.5+git.134.674d33703a6-3.3.1 SUSE Linux Enterprise Server 12-SP5 (src): samba-4.10.5+git.134.674d33703a6-3.3.1 SUSE Linux Enterprise High Availability 12-SP5 (src): samba-4.10.5+git.134.674d33703a6-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0223-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1141320,1160850,1160852,1160888 CVE References: CVE-2019-14902,CVE-2019-14907,CVE-2019-19344 Sources used: SUSE Linux Enterprise Module for Python2 15-SP1 (src): samba-4.9.5+git.243.e76c5cb3d97-3.21.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): samba-4.9.5+git.243.e76c5cb3d97-3.21.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): samba-4.9.5+git.243.e76c5cb3d97-3.21.1 SUSE Linux Enterprise High Availability 15-SP1 (src): samba-4.9.5+git.243.e76c5cb3d97-3.21.1 SUSE Enterprise Storage 6 (src): samba-4.9.5+git.243.e76c5cb3d97-3.21.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0224-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1160850,1160888 CVE References: CVE-2019-14902,CVE-2019-14907 Sources used: SUSE Linux Enterprise Server for SAP 15 (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 SUSE Linux Enterprise Server 15-LTSS (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15 (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 SUSE Linux Enterprise Module for Basesystem 15 (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 SUSE Linux Enterprise High Availability 15 (src): samba-4.7.11+git.218.58b95cbfc0f-4.37.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0233-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1160888 CVE References: CVE-2019-14907 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE OpenStack Cloud 8 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise Server 12-SP4 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise High Availability 12-SP4 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise High Availability 12-SP3 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Linux Enterprise Desktop 12-SP4 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 SUSE Enterprise Storage 5 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 HPE Helion Openstack 8 (src): samba-4.6.16+git.174.c2fd2e28c84-3.49.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0122-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1141320,1160850,1160852,1160888 CVE References: CVE-2019-14902,CVE-2019-14907,CVE-2019-19344 Sources used: openSUSE Leap 15.1 (src): samba-4.9.5+git.243.e76c5cb3d97-lp151.2.15.1
In SLE12 we do not include / support the Samba AD functionality. Done
SUSE-SU-2020:2673-1: An update that fixes 15 vulnerabilities is now available. Category: security (important) Bug References: 1141267,1144902,1154289,1154598,1158108,1158109,1160850,1160852,1160888,1169850,1169851,1173159,1173160,1173359,1174120 CVE References: CVE-2019-10197,CVE-2019-10218,CVE-2019-14833,CVE-2019-14847,CVE-2019-14861,CVE-2019-14870,CVE-2019-14902,CVE-2019-14907,CVE-2019-19344,CVE-2020-10700,CVE-2020-10704,CVE-2020-10730,CVE-2020-10745,CVE-2020-10760,CVE-2020-14303 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): ldb-1.5.8-3.5.1, samba-4.10.17+git.203.862547088ca-3.14.1 SUSE Linux Enterprise Server 12-SP5 (src): ldb-1.5.8-3.5.1, samba-4.10.17+git.203.862547088ca-3.14.1 SUSE Linux Enterprise High Availability 12-SP5 (src): samba-4.10.17+git.203.862547088ca-3.14.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.