Bug 958583 (CVE-2015-5299) - VUL-0: CVE-2015-5299: samba: Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2)
Summary: VUL-0: CVE-2015-5299: samba: Currently the snapshot browsing is not secure th...
Status: RESOLVED FIXED
Alias: CVE-2015-5299
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2015-12-24
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:running:62372:moderate CVSSv2:S...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-10 06:36 UTC by Marcus Meissner
Modified: 2016-04-20 10:12 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 8 Marcus Meissner 2015-12-10 07:26:01 UTC 
Samba people, any kind of easy reproducer for our QA?
Comment 9 SMASH SMASH 2015-12-10 10:20:38 UTC 
An update workflow for this issue was started.

This issue was rated as "low".
Please submit fixed packages until "Dec. 17, 2015".

When done, reassign the bug to "security-team@suse.de".
/update/121110/.
Comment 10 Swamp Workflow Management 2015-12-10 11:09:53 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-12-24.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62372
Comment 11 SMASH SMASH 2015-12-10 11:10:04 UTC 
An update workflow for this issue was started.

This issue was rated as "moderate".
Please submit fixed packages until "Dec. 17, 2015".

When done, reassign the bug to "security-team@suse.de".
/update/62372/.
Comment 12 Swamp Workflow Management 2015-12-10 23:00:42 UTC 
bugbot adjusting priority
Comment 15 Marcus Meissner 2015-12-16 11:52:26 UTC 
is public

https://www.samba.org/samba/security/CVE-2015-5299.html

===========================================================
== Subject:     Missing access control check in shadow copy
==		code.
==
== CVE ID#:     CVE-2015-5299
==
== Versions:    Versions of Samba from 3.2.0 to 4.3.2
==
== Summary:     A missing access control check in the VFS
==		shadow_copy2 module could allow unauthorized
==		users to access snapshots.
==
===========================================================

===========
Description
===========

All versions of Samba from 3.2.0 to 4.3.2 inclusive are vulnerable to
a missing access control check in the vfs_shadow_copy2 module. When
looking for the shadow copy directory under the share path the current
accessing user should have DIRECTORY_LIST access rights in order to
view the current snapshots.

This was not being checked in the affected versions of Samba.

==================
Patch Availability
==================

Patches addressing this defect have been posted to

 https://www.samba.org/samba/history/security.html

Additionally, Samba 4.3.3, 4.2.7 and 4.1.22 have been issued as
security releases to correct the defect.
Samba vendors and administrators running affected versions are
advised to upgrade or apply the patch as soon as possible.

===========
Workarounds
===========

None.

=======
Credits
=======

The problem was found by  who
also provided the fix for the code.
Comment 16 Bernhard Wiedemann 2015-12-16 17:00:28 UTC 
This is an autogenerated message for OBS integration:
This bug (958583) was mentioned in
https://build.opensuse.org/request/show/349211 Factory / samba
Comment 17 Swamp Workflow Management 2015-12-18 20:14:40 UTC 
SUSE-SU-2015:2304-1: An update that solves 6 vulnerabilities and has 17 fixes is now available.

Category: security (important)
Bug References: 295284,773464,872912,901813,902421,910378,912457,913304,923374,931854,936909,939051,947552,949022,951660,953382,954658,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-8467
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    ldb-1.1.24-4.3.1, samba-4.1.12-18.3.1, talloc-2.1.5-3.4.1, tdb-1.3.8-2.3.1, tevent-0.9.26-3.3.1
SUSE Linux Enterprise Server 12 (src):    ldb-1.1.24-4.3.1, samba-4.1.12-18.3.1, talloc-2.1.5-3.4.1, tdb-1.3.8-2.3.1, tevent-0.9.26-3.3.1
SUSE Linux Enterprise Desktop 12 (src):    ldb-1.1.24-4.3.1, samba-4.1.12-18.3.1, talloc-2.1.5-3.4.1, tdb-1.3.8-2.3.1, tevent-0.9.26-3.3.1
Comment 18 Swamp Workflow Management 2015-12-18 21:12:11 UTC 
SUSE-SU-2015:2305-1: An update that solves 6 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 949022,951660,954658,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-8467
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    ldb-1.1.24-4.1, samba-4.2.4-6.1, talloc-2.1.5-4.1, tdb-1.3.8-4.1, tevent-0.9.26-4.1
SUSE Linux Enterprise Server 12-SP1 (src):    ldb-1.1.24-4.1, samba-4.2.4-6.1, talloc-2.1.5-4.1, tdb-1.3.8-4.1, tevent-0.9.26-4.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    ldb-1.1.24-4.1, samba-4.2.4-6.1, talloc-2.1.5-4.1, tdb-1.3.8-4.1, tevent-0.9.26-4.1
Comment 19 James McDonough 2015-12-23 22:14:53 UTC 
Submitted for gplv3 repo in SLE10-SP3.  SLE11-SP1 also submitted but it complained.

If needed, the SLE11-SP1 package is in:
home:lmuelle:branches:OBS_Maintained:samba
Comment 20 Swamp Workflow Management 2015-12-24 02:11:57 UTC 
openSUSE-SU-2015:2354-1: An update that solves 6 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 949022,951660,954658,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-8467
Sources used:
openSUSE Leap 42.1 (src):    ldb-1.1.24-7.1, samba-4.2.4-9.2, talloc-2.1.5-7.1, tdb-1.3.8-7.1, tevent-0.9.26-7.1
Comment 21 Swamp Workflow Management 2015-12-24 15:12:24 UTC 
openSUSE-SU-2015:2356-1: An update that solves 7 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 939050,939051,949022,951660,953382,954658,958580,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-7540,CVE-2015-8467
Sources used:
openSUSE 13.2 (src):    ldb-1.1.24-3.4.1, samba-4.1.22-21.1, talloc-2.1.5-2.6.1, tdb-1.3.8-3.1, tevent-0.9.26-3.1
openSUSE 13.1 (src):    ldb-1.1.24-3.7.1, samba-4.1.22-3.46.1, talloc-2.1.5-7.10.1, tdb-1.3.8-4.7.1, tevent-0.9.26-4.7.1
Comment 22 Swamp Workflow Management 2016-01-05 19:16:56 UTC 
SUSE-SU-2016:0032-1: An update that solves four vulnerabilities and has 8 fixes is now available.

Category: security (important)
Bug References: 295284,773464,901813,912457,913304,934299,948244,949022,958582,958583,958584,958586
CVE References: CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330
Sources used:
SUSE Linux Enterprise Server 11-SP2-LTSS (src):    samba-3.6.3-45.2, samba-doc-3.6.3-45.2
SUSE Linux Enterprise Debuginfo 11-SP2 (src):    samba-3.6.3-45.2
Comment 23 Marcus Meissner 2016-01-11 13:04:36 UTC 
done
Comment 26 Swamp Workflow Management 2016-01-19 12:14:28 UTC 
SUSE-SU-2016:0164-1: An update that solves four vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 295284,912457,934299,936909,948244,949022,953382,958582,958583,958584,958586
CVE References: CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    samba-3.6.3-64.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    samba-3.6.3-64.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Server 11-SP4 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Server 11-SP3 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    samba-3.6.3-64.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    samba-3.6.3-64.1
Comment 27 Swamp Workflow Management 2016-04-17 13:14:57 UTC 
openSUSE-SU-2016:1064-1: An update that solves 16 vulnerabilities and has 17 fixes is now available.

Category: security (important)
Bug References: 898031,901813,912457,913238,913547,914279,917376,919309,924519,936862,942716,946051,947552,949022,958581,958582,958583,958584,958585,958586,964023,966271,968222,968973,971965,972197,973031,973032,973033,973034,973036,973832,974629
CVE References: CVE-2014-8143,CVE-2015-0240,CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2015-8467,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE 13.2 (src):    samba-4.2.4-34.1
Comment 28 Swamp Workflow Management 2016-04-20 10:09:18 UTC 
openSUSE-SU-2016:1106-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 844720,849224,853347,917376,936862,958582,958583,958584,958586,968222,971965,973031,973032,973033,973034,973035,973036
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4496,CVE-2015-0240,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2114,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE 13.1 (src):    samba-4.2.4-3.54.2
Comment 29 Swamp Workflow Management 2016-04-20 10:12:22 UTC 
openSUSE-SU-2016:1107-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 844720,849224,853347,917376,936862,958582,958583,958584,958586,968222,971965,973031,973032,973033,973034,973035,973036
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4496,CVE-2015-0240,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2114,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE Evergreen 11.4 (src):    samba-3.6.3-141.1, samba-doc-3.6.3-141.1