Bug 844720 (CVE-2013-4408) - VUL-0: CVE-2013-4408: samba: DCERPC frag_len not checked
Summary: VUL-0: CVE-2013-4408: samba: DCERPC frag_len not checked
Status: RESOLVED FIXED
Alias: CVE-2013-4408
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2013-11-04
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:sle11-sp1:55441 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-08 15:24 UTC by Marcus Meissner
Modified: 2016-04-20 10:11 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 11 Marcus Meissner 2013-12-09 10:19:55 UTC 
Is public now.

http://www.samba.org/samba/security/CVE-2013-4408

===========================================================
== Subject:     DCE-RPC fragment length field is incorrectly checked.
==
== CVE ID#:     CVE-2013-4408
==
== Versions:    All versions of Samba later than 3.4.0
==
== Summary:     Incorrect length checks on DCE-RPC fragment lengths
==              cause Samba client utilities including winbindd to
==              be vulnerable to buffer overrun exploits.
==
===========================================================

===========
Description
===========

Samba versions 3.4.0 and above (versions 3.4.0 - 3.4.17, 3.5.0 -
3.5.22, 3.6.0 - 3.6.21, 4.0.0 - 4.0.12 and including 4.1.2) are
vulnerable to buffer overrun exploits in the client processing of
DCE-RPC packets. This is due to incorrect checking of the DCE-RPC
fragment length in the client code.

This is a critical vulnerability as the DCE-RPC client code is part of
the winbindd authentication and identity mapping daemon, which is
commonly configured as part of many server installations (when joined
to an Active Directory Domain). A malicious Active Directory Domain
Controller or man-in-the-middle attacker impersonating an Active
Directory Domain Controller could achieve root-level access by
compromising the winbindd process.

Samba server versions 3.4.0 - 3.4.17 and versions 3.5.0 - 3.5.22 are
also vulnerable to a denial of service attack (server crash) due to a
similar error in the server code of those versions.

Samba server versions 3.6.0 and above (including all 3.6.x versions,
all 4.0.x versions and 4.1.x) are not vulnerable to this problem.

In addition range checks were missing on arguments returned from calls
to the DCE-RPC functions LookupSids (lsa and samr), LookupNames (lsa and samr)
and LookupRids (samr) which could also cause similar problems.

As this was found during an internal audit of the Samba code there are
no currently known exploits for this problem (as of December 9th 2013).

==================
Patch Availability
==================

Patches addressing all these issues have been posted to:

    http://www.samba.org/samba/security/

Samba versions 3.6.22, 4.0.13, and 4.1.3 have been released to
address this issue. Patches for 3.4.17 and 3.5.22 are available at the above URL.

==========
Workaround
==========

None.

=======
Credits
=======

This problem was found by an internal audit of the Samba code by
Stefan Metzmacher and Michael Adam of SerNet.

Patches provided by Stefan Metzmacher and Jeremy Allison of the Samba
team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================
Comment 12 Bernhard Wiedemann 2013-12-09 16:00:13 UTC 
This is an autogenerated message for OBS integration:
This bug (844720) was mentioned in
https://build.opensuse.org/request/show/210027 Factory / samba
Comment 13 Bernhard Wiedemann 2013-12-10 18:00:12 UTC 
This is an autogenerated message for OBS integration:
This bug (844720) was mentioned in
https://build.opensuse.org/request/show/210422 13.1 / samba
https://build.opensuse.org/request/show/210423 12.3 / samba
Comment 14 Bernhard Wiedemann 2013-12-10 19:00:13 UTC 
This is an autogenerated message for OBS integration:
This bug (844720) was mentioned in
https://build.opensuse.org/request/show/210424 12.2 / samba
Comment 19 Swamp Workflow Management 2013-12-19 17:05:05 UTC 
openSUSE-SU-2013:1921-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 844720,848101,848103,853021,853347
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4475,CVE-2013-4476
Sources used:
openSUSE 13.1 (src):    samba-4.1.3-3.12.1
Comment 20 Swamp Workflow Management 2014-01-06 15:04:37 UTC 
Update released for: cifs-mount, ldapsmb, libnetapi-devel, libnetapi0, libsmbclient-devel, libsmbclient0, libsmbclient0-32bit, libsmbsharemodes-devel, libsmbsharemodes0, libtalloc-devel, libtalloc1, libtalloc1-32bit, libtdb-devel, libtdb1, libtdb1-32bit, libwbclient-devel, libwbclient0, libwbclient0-32bit, samba, samba-32bit, samba-client, samba-client-32bit, samba-debuginfo, samba-debuginfo-32bit, samba-debugsource, samba-devel, samba-doc, samba-krb-printing, samba-vscan, samba-winbind, samba-winbind-32bit
Products:
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 21 Swamp Workflow Management 2014-01-06 19:16:06 UTC 
Update released for: cifs-mount, ldapsmb, libldb-devel, libldb1, libldb1-32bit, libldb1-x86, libnetapi-devel, libnetapi0, libsmbclient-devel, libsmbclient0, libsmbclient0-32bit, libsmbclient0-x86, libsmbsharemodes-devel, libsmbsharemodes0, libtalloc-devel, libtalloc1, libtalloc1-32bit, libtalloc1-x86, libtalloc2, libtalloc2-32bit, libtalloc2-x86, libtdb-devel, libtdb1, libtdb1-32bit, libtdb1-x86, libtevent-devel, libtevent0, libtevent0-32bit, libtevent0-x86, libwbclient-devel, libwbclient0, libwbclient0-32bit, libwbclient0-x86, samba, samba-32bit, samba-client, samba-client-32bit, samba-client-x86, samba-debuginfo, samba-debuginfo-32bit, samba-debuginfo-x86, samba-debugsource, samba-devel, samba-doc, samba-krb-printing, samba-vscan, samba-winbind, samba-winbind-32bit, samba-winbind-x86, samba-x86
Products:
SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP2 (i386, x86_64)
SLE-SDK 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP2 (i386, x86_64)
Comment 22 Swamp Workflow Management 2014-01-06 19:36:48 UTC 
Update released for: cifs-mount, ldapsmb, libldb-devel, libldb1, libldb1-32bit, libldb1-x86, libnetapi-devel, libnetapi0, libsmbclient-devel, libsmbclient0, libsmbclient0-32bit, libsmbclient0-x86, libsmbsharemodes-devel, libsmbsharemodes0, libtalloc-devel, libtalloc1, libtalloc1-32bit, libtalloc1-x86, libtalloc2, libtalloc2-32bit, libtalloc2-x86, libtdb-devel, libtdb1, libtdb1-32bit, libtdb1-x86, libtevent-devel, libtevent0, libtevent0-32bit, libtevent0-x86, libwbclient-devel, libwbclient0, libwbclient0-32bit, libwbclient0-x86, samba, samba-32bit, samba-client, samba-client-32bit, samba-client-x86, samba-debuginfo, samba-debuginfo-32bit, samba-debuginfo-x86, samba-debugsource, samba-devel, samba-doc, samba-krb-printing, samba-vscan, samba-winbind, samba-winbind-32bit, samba-winbind-x86, samba-x86
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 23 Swamp Workflow Management 2014-01-06 23:05:08 UTC 
SUSE-SU-2014:0024-1: An update that solves three vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 817880,838472,844720,848101,849226,853021,853347,854520
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4475
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    samba-3.6.3-0.46.1
SUSE Linux Enterprise Software Development Kit 11 SP2 (src):    samba-3.6.3-0.33.39.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    samba-3.6.3-0.46.1, samba-doc-3.6.3-0.46.1
SUSE Linux Enterprise Server 11 SP3 (src):    samba-3.6.3-0.46.1, samba-doc-3.6.3-0.46.1
SUSE Linux Enterprise Server 11 SP2 for VMware (src):    samba-3.4.3-1.50.1, samba-3.6.3-0.33.39.1, samba-doc-3.6.3-0.33.39.1
SUSE Linux Enterprise Server 11 SP2 (src):    samba-3.4.3-1.50.1, samba-3.6.3-0.33.39.1, samba-doc-3.6.3-0.33.39.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    samba-3.6.3-0.46.1, samba-doc-3.6.3-0.46.1
SUSE Linux Enterprise Desktop 11 SP2 (src):    samba-3.4.3-1.50.1, samba-3.6.3-0.33.39.1, samba-doc-3.6.3-0.33.39.1
Comment 24 Bernhard Wiedemann 2014-03-12 11:01:15 UTC 
This is an autogenerated message for OBS integration:
This bug (844720) was mentioned in
https://build.opensuse.org/request/show/225656 12.3 / samba
Comment 25 Bernhard Wiedemann 2014-03-12 15:01:14 UTC 
This is an autogenerated message for OBS integration:
This bug (844720) was mentioned in
https://build.opensuse.org/request/show/225704 12.3 / samba
Comment 26 Swamp Workflow Management 2014-03-20 07:11:43 UTC 
openSUSE-SU-2014:0405-1: An update that solves three vulnerabilities and has 9 fixes is now available.

Category: security (moderate)
Bug References: 437293,741623,755663,786677,844307,844720,849224,853021,853347,854520,863748,865561
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4496
Sources used:
openSUSE 12.3 (src):    samba-3.6.12-59.19.1, samba-doc-3.6.12-59.19.1
Comment 27 Swamp Workflow Management 2014-03-24 20:19:31 UTC 
Update released for: ifolder3-enterprise, novell-afptcpd, novell-afptcpd-interfaces, novell-afptcpd-interfaces-32bit, novell-cifs, novell-cifs-interfaces, novell-cifs-interfaces-32bit, novell-iprint-iprntman, novell-migration-gui-base, novell-nrm, novell-oes-pure-ftpd, novell-oes-samba, novell-oes-samba-32bit, novell-oes-samba-cifs-mount, novell-oes-samba-client, novell-oes-samba-client-32bit, novell-oes-samba-krb-printing, novell-oes-samba-ldapsmb, novell-oes-samba-libldb1, novell-oes-samba-libnetapi0, novell-oes-samba-libsmbclient0, novell-oes-samba-libsmbclient0-32bit, novell-oes-samba-libsmbsharemodes0, novell-oes-samba-libtalloc1, novell-oes-samba-libtalloc1-32bit, novell-oes-samba-libtalloc2, novell-oes-samba-libtalloc2-32bit, novell-oes-samba-libtdb1, novell-oes-samba-libtdb1-32bit, novell-oes-samba-libtevent0, novell-oes-samba-libtevent0-32bit, novell-oes-samba-libwbclient0, novell-oes-samba-libwbclient0-32bit, novell-oes-samba-winbind, novell-oes-samba-winbind-32bit, novell-vigil-vlog, novell-xad-framework
Products:
Open-Enterprise-Server 11-SP2 (x86_64)
Comment 28 Swamp Workflow Management 2014-05-28 14:50:53 UTC 
Update released for: cifs-mount, ldapsmb, libnetapi-devel, libnetapi0, libsmbclient-devel, libsmbclient0, libsmbclient0-32bit, libsmbclient0-x86, libsmbsharemodes-devel, libsmbsharemodes0, libtalloc-devel, libtalloc1, libtalloc1-32bit, libtalloc1-x86, libtdb-devel, libtdb1, libtdb1-32bit, libtdb1-x86, libwbclient-devel, libwbclient0, libwbclient0-32bit, libwbclient0-x86, samba, samba-32bit, samba-client, samba-client-32bit, samba-client-x86, samba-debuginfo, samba-debuginfo-32bit, samba-debuginfo-x86, samba-debugsource, samba-devel, samba-doc, samba-krb-printing, samba-vscan, samba-winbind, samba-winbind-32bit, samba-winbind-x86, samba-x86
Products:
SLE-DEBUGINFO 11-SP1 (i386, s390x, x86_64)
SLE-SERVER 11-SP1-LTSS (i386, s390x, x86_64)
Comment 29 Swamp Workflow Management 2014-05-28 18:05:17 UTC 
SUSE-SU-2014:0723-1: An update that solves 6 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 783384,799641,800982,829969,844720,849224,853021,853347
CVE References: CVE-2012-6150,CVE-2013-0213,CVE-2013-0214,CVE-2013-4124,CVE-2013-4408,CVE-2013-4496
Sources used:
SUSE Linux Enterprise Server 11 SP1 LTSS (src):    samba-3.4.3-1.52.3, samba-doc-3.4.3-1.52.3
Comment 30 Swamp Workflow Management 2016-04-20 10:07:55 UTC 
openSUSE-SU-2016:1106-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 844720,849224,853347,917376,936862,958582,958583,958584,958586,968222,971965,973031,973032,973033,973034,973035,973036
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4496,CVE-2015-0240,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2114,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE 13.1 (src):    samba-4.2.4-3.54.2
Comment 31 Swamp Workflow Management 2016-04-20 10:11:18 UTC 
openSUSE-SU-2016:1107-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 844720,849224,853347,917376,936862,958582,958583,958584,958586,968222,971965,973031,973032,973033,973034,973035,973036
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4496,CVE-2015-0240,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2114,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE Evergreen 11.4 (src):    samba-3.6.3-141.1, samba-doc-3.6.3-141.1