[Pkg-samba-maint] [Git][samba-team/samba][buster-security] 43 commits: CVE-2020-25722 Ensure the structural objectclass cannot be changed

Sat Nov 27 09:57:40 GMT 2021

Salvatore Bonaccorso pushed to branch buster-security at Debian Samba Team / samba

Commits:
075a0298 by Andrew Bartlett at 2021-11-22T13:43:22+01:00
CVE-2020-25722 Ensure the structural objectclass cannot be changed

If the structural objectclass is allowed to change, then the restrictions
locking an object to remaining a user or computer will not be enforcable.

Likewise other LDAP inheritance rules, which allow only certain
child objects can be bypassed, which can in turn allow creation of
(unprivileged) users where only DNS objects were expected.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14889

Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Joseph Sutton <josephsutton at catalyst.net.nz>

[jsutton at samba.org Adapted knownfails to ad_dc_ntvfs and fixed knownfail
 conflicts]

- - - - -
799d8e07 by Andrew Bartlett at 2021-11-22T13:43:31+01:00
CVE-2020-25722 dsdb: Restrict the setting of privileged attributes during LDAP add/modify

The remaining failures in the priv_attrs (not the strict one) test are
due to missing objectclass constraints on the administrator which should
be addressed, but are not a security issue.

A better test for confirming constraints between objectclass and
userAccountControl UF_NORMAL_ACCONT/UF_WORKSTATION_TRUST values would
be user_account_control.py.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14703
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14778
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14775

Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>

- - - - -
b12ef302 by Salvatore Bonaccorso at 2021-11-22T13:49:28+01:00
Add patches for CVE-2020-25722

- - - - -
c46ccd69 by Ralph Boehme at 2021-11-22T13:51:27+01:00
s3/auth: use set_current_user_info() in auth3_generate_session_info_pac()

This delays reloading config slightly, but I don't see how could affect
observable behaviour other then log messages coming from the functions in
between the different locations for lp_load_with_shares() like
make_session_info_krb5() are sent to a different logfile if "log file" uses %U.

Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
(cherry picked from commit dc4b1e39ce1f2201a2d6ae2d4cffef2448f69a62)

[scabrero at samba.org Prerequisite for CVE-2020-25717 backport]

- - - - -
bad7935b by Samuel Cabrero at 2021-11-22T13:51:27+01:00
selftest: Fix ktest usermap file

The user was not mapped:

user_in_list: checking user |KTEST/administrator| against |KTEST\Administrator|
The user 'KTEST/administrator' has no mapping. Skip it next time.

Signed-off-by: Samuel Cabrero <scabrero at samba.org>

[scabrero at samba.org Once smb_getpswnam() fallbacks are removed the user
 has to be mapped]

- - - - -
98da177d by Stefan Metzmacher at 2021-11-22T13:51:27+01:00
selftest/Samba3: replace (winbindd => "yes", skip_wait => 1) with (winbindd => "offline")

This is much more flexible and concentrates the logic in a single place.

We'll use winbindd => "offline" in other places soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14870
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881

Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Andrew Bartlett <abartlet at samba.org>
(cherry picked from commit 4dc3c68c9a28f71888e3d6dd3b1f0bcdb8fa45de)
(cherry picked from commit 89b9cb8b786c3e4eb8691b5363390b68d8228a2d)

[scabrero at samba.org Backported to 4.10]

- - - - -
4d5d75d7 by Stefan Metzmacher at 2021-11-22T13:51:27+01:00
CVE-2020-25719 CVE-2020-25717: selftest: remove "gensec:require_pac" settings

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze at samba.org>

- - - - -
c644de47 by Stefan Metzmacher at 2021-11-22T13:51:27+01:00
CVE-2020-25717: s3:winbindd: make sure we default to r->out.authoritative = true

We need to make sure that temporary failures don't trigger a fallback
to the local SAM that silently ignores the domain name part for users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze at samba.org>

[scabrero at samba.org Backported for 4.10 due to no logon_id for
log_authentication() neither is_allowed_domain()]

- - - - -
505ffe1d by Stefan Metzmacher at 2021-11-22T13:51:27+01:00
CVE-2020-25717: s4:auth/ntlm: make sure auth_check_password() defaults to r->out.authoritative = true

We need to make sure that temporary failures don't trigger a fallback
to the local SAM that silently ignores the domain name part for users.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze at samba.org>

- - - - -
309d0476 by Stefan Metzmacher at 2021-11-22T13:51:27+01:00
CVE-2020-25717: s4:torture: start with authoritative = 1