<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">

<html lang="en">

<head>

<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">

<title>

GitLab

</title>

<style>img {

max-width: 100%; height: auto;

}

</style>

</head>

<body>

<div class="content">

<h3>

Salvatore Bonaccorso pushed to branch buster-security

at <a href="https://salsa.debian.org/samba-team/samba">Debian Samba Team / samba</a>

</h3>

<h4>

Commits:

</h4>

<ul>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/075a0298b1ac07686e9dcc7b8b639f2b64744e27">075a0298</a></strong>

<div>

<span>by Andrew Bartlett</span>

<i>at 2021-11-22T13:43:22+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2020-25722 Ensure the structural objectclass cannot be changed

If the structural objectclass is allowed to change, then the restrictions

locking an object to remaining a user or computer will not be enforcable.

Likewise other LDAP inheritance rules, which allow only certain

child objects can be bypassed, which can in turn allow creation of

(unprivileged) users where only DNS objects were expected.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14889

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>

[jsutton@samba.org Adapted knownfails to ad_dc_ntvfs and fixed knownfail

 conflicts]

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/799d8e078616e18463af6d4433634b090cd6e7ae">799d8e07</a></strong>

<div>

<span>by Andrew Bartlett</span>

<i>at 2021-11-22T13:43:31+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2020-25722 dsdb: Restrict the setting of privileged attributes during LDAP add/modify

The remaining failures in the priv_attrs (not the strict one) test are

due to missing objectclass constraints on the administrator which should

be addressed, but are not a security issue.

A better test for confirming constraints between objectclass and

userAccountControl UF_NORMAL_ACCONT/UF_WORKSTATION_TRUST values would

be user_account_control.py.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14703

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14778

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14775

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/b12ef30250911b91539094bc7895ccd3bb7d374f">b12ef302</a></strong>

<div>

<span>by Salvatore Bonaccorso</span>

<i>at 2021-11-22T13:49:28+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add patches for CVE-2020-25722

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/c46ccd69e2dddd271fa3ed7d424361d461a817be">c46ccd69</a></strong>

<div>

<span>by Ralph Boehme</span>

<i>at 2021-11-22T13:51:27+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">s3/auth: use set_current_user_info() in auth3_generate_session_info_pac()

This delays reloading config slightly, but I don't see how could affect

observable behaviour other then log messages coming from the functions in

between the different locations for lp_load_with_shares() like

make_session_info_krb5() are sent to a different logfile if "log file" uses %U.

Signed-off-by: Ralph Boehme <slow@samba.org>

Reviewed-by: Andreas Schneider <asn@samba.org>

(cherry picked from commit dc4b1e39ce1f2201a2d6ae2d4cffef2448f69a62)

[scabrero@samba.org Prerequisite for CVE-2020-25717 backport]

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/bad7935b16598764b24815e7c21464c30d4ed1c4">bad7935b</a></strong>

<div>

<span>by Samuel Cabrero</span>

<i>at 2021-11-22T13:51:27+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">selftest: Fix ktest usermap file

The user was not mapped:

user_in_list: checking user |KTEST/administrator| against |KTEST\Administrator|

The user 'KTEST/administrator' has no mapping. Skip it next time.

Signed-off-by: Samuel Cabrero <scabrero@samba.org>

[scabrero@samba.org Once smb_getpswnam() fallbacks are removed the user

 has to be mapped]

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/98da177d89c201826a4b8f10a64342f59156a9d5">98da177d</a></strong>

<div>

<span>by Stefan Metzmacher</span>

<i>at 2021-11-22T13:51:27+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">selftest/Samba3: replace (winbindd => "yes", skip_wait => 1) with (winbindd => "offline")

This is much more flexible and concentrates the logic in a single place.

We'll use winbindd => "offline" in other places soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14870

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

(cherry picked from commit 4dc3c68c9a28f71888e3d6dd3b1f0bcdb8fa45de)

(cherry picked from commit 89b9cb8b786c3e4eb8691b5363390b68d8228a2d)

[scabrero@samba.org Backported to 4.10]

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/4d5d75d73c8d496a557d6b49e4d6b84b200e66f2">4d5d75d7</a></strong>

<div>

<span>by Stefan Metzmacher</span>

<i>at 2021-11-22T13:51:27+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2020-25719 CVE-2020-25717: selftest: remove "gensec:require_pac" settings

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/c644de47b98e4dff44efcf58d7262e77ae4a401d">c644de47</a></strong>

<div>

<span>by Stefan Metzmacher</span>

<i>at 2021-11-22T13:51:27+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2020-25717: s3:winbindd: make sure we default to r->out.authoritative = true

We need to make sure that temporary failures don't trigger a fallback

to the local SAM that silently ignores the domain name part for users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>

[scabrero@samba.org Backported for 4.10 due to no logon_id for

log_authentication() neither is_allowed_domain()]

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/505ffe1d9c8788a6ff0d853db2df40c43f806b4c">505ffe1d</a></strong>

<div>

<span>by Stefan Metzmacher</span>

<i>at 2021-11-22T13:51:27+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2020-25717: s4:auth/ntlm: make sure auth_check_password() defaults to r->out.authoritative = true

We need to make sure that temporary failures don't trigger a fallback

to the local SAM that silently ignores the domain name part for users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>

</pre>

</li>

<li>

<strong><a href="https://salsa.debian.org/samba-team/samba/-/commit/309d04765d790f5da8cbc4e99986b1ece0eaff2e">309d0476</a></strong>

<div>

<span>by Stefan Metzmacher</span>

<i>at 2021-11-22T13:51:27+01:00</i>

</div>

<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2020-25717: s4:torture: start with authoritative = 1

This is not strictly needed, but makes it easier to audit