Ubuntu update for Samba

Published: 2019-10-30

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2019-14847 CVE-2019-14833 CVE-2019-10218
CWE-ID	CWE-476 CWE-477 CWE-22
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	samba (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU22331

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14847

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within implementation of the MS-ADTS "3.1.1.3.1.3.3 Range Retrieval of Attribute Values" feature. A remote user with "get changes" extended access right can trigger NULL pointer dereference error and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.

Ubuntu 19.10: libsmbclient - 2:4.10.7+dfsg-0ubuntu2.2; samba - 2:4.10.7+dfsg-0ubuntu2.2
Ubuntu 19.04: libsmbclient - 2:4.10.0+dfsg-0ubuntu2.6; samba - 2:4.10.0+dfsg-0ubuntu2.6
Ubuntu 18.04 LTS: libsmbclient - 2:4.7.6+dfsg~ubuntu-0ubuntu2.13; samba - 2:4.7.6+dfsg~ubuntu-0ubuntu2.13
Ubuntu 16.04 LTS: libsmbclient - 2:4.3.11+dfsg-0ubuntu0.16.04.23; samba - 2:4.3.11+dfsg-0ubuntu0.16.04.23

Vulnerable software versions

samba (Ubuntu package): 2:4.3.11+dfsg-0ubuntu0.16.04.1 - 2:4.10.7+dfsg-0ubuntu2

External links

http://usn.ubuntu.com/4167-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use of Obsolete Function

EUVDB-ID: #VU22330

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14833

CWE-ID: CWE-477 - Use of Obsolete Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented password policy.

The vulnerability exists due to Samba does not pass the entire user's password when configured to use custom command to verify password complexity, if the password contains multibyte non-ACSII characters. A remote authenticated user can bypass implemented password policy and create weak passwords.

Mitigation

Update the affected packages.

Ubuntu 19.10: libsmbclient - 2:4.10.7+dfsg-0ubuntu2.2; samba - 2:4.10.7+dfsg-0ubuntu2.2
Ubuntu 19.04: libsmbclient - 2:4.10.0+dfsg-0ubuntu2.6; samba - 2:4.10.0+dfsg-0ubuntu2.6
Ubuntu 18.04 LTS: libsmbclient - 2:4.7.6+dfsg~ubuntu-0ubuntu2.13; samba - 2:4.7.6+dfsg~ubuntu-0ubuntu2.13
Ubuntu 16.04 LTS: libsmbclient - 2:4.3.11+dfsg-0ubuntu0.16.04.23; samba - 2:4.3.11+dfsg-0ubuntu0.16.04.23

Vulnerable software versions

samba (Ubuntu package): 2:4.3.11+dfsg-0ubuntu0.16.04.1 - 2:4.10.7+dfsg-0ubuntu2

External links

http://usn.ubuntu.com/4167-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Path traversal

EUVDB-ID: #VU22329

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10218

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in filenames within Samba client code (libsmbclient). A malicious SMB server can return a filename to the client containing directory traversal characters and force the client to read or write data to local files.

Successful exploitation of the vulnerability may allow an attacker to overwrite arbitrary files on the client.

Mitigation

Update the affected packages.

Ubuntu 19.10: libsmbclient - 2:4.10.7+dfsg-0ubuntu2.2; samba - 2:4.10.7+dfsg-0ubuntu2.2
Ubuntu 19.04: libsmbclient - 2:4.10.0+dfsg-0ubuntu2.6; samba - 2:4.10.0+dfsg-0ubuntu2.6
Ubuntu 18.04 LTS: libsmbclient - 2:4.7.6+dfsg~ubuntu-0ubuntu2.13; samba - 2:4.7.6+dfsg~ubuntu-0ubuntu2.13
Ubuntu 16.04 LTS: libsmbclient - 2:4.3.11+dfsg-0ubuntu0.16.04.23; samba - 2:4.3.11+dfsg-0ubuntu0.16.04.23

Vulnerable software versions

samba (Ubuntu package): 2:4.3.11+dfsg-0ubuntu0.16.04.1 - 2:4.10.7+dfsg-0ubuntu2

External links

http://usn.ubuntu.com/4167-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.