Bug 958586 (CVE-2015-5330) - VUL-0: CVE-2015-5330: samba: Remote read memory exploit in LDB
Summary: VUL-0: CVE-2015-5330: samba: Remote read memory exploit in LDB
Status: RESOLVED FIXED
Alias: CVE-2015-5330
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2015-12-24
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2015-5330:4.0:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-10 06:40 UTC by Marcus Meissner
Modified: 2016-04-20 10:12 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 9 SMASH SMASH 2015-12-10 10:21:00 UTC 
An update workflow for this issue was started.

This issue was rated as "moderate".
Please submit fixed packages until "Dec. 17, 2015".

When done, reassign the bug to "security-team@suse.de".
/update/121110/.
Comment 10 Swamp Workflow Management 2015-12-10 11:08:02 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-12-24.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62372
Comment 11 SMASH SMASH 2015-12-10 11:10:28 UTC 
An update workflow for this issue was started.

This issue was rated as "moderate".
Please submit fixed packages until "Dec. 17, 2015".

When done, reassign the bug to "security-team@suse.de".
/update/62372/.
Comment 12 Swamp Workflow Management 2015-12-10 23:01:08 UTC 
bugbot adjusting priority
Comment 16 Marcus Meissner 2015-12-16 11:55:26 UTC 
is public

https://www.samba.org/samba/security/CVE-2015-5330.html

===========================================================
== Subject:     Remote memory read in Samba LDAP server.
==
== CVE ID#:     CVE-2015-5330
==
== Versions:    Samba 4.0.0 to 4.3.2
==
== Summary:     Malicious request can cause Samba LDAP server
==		to return uninitialized memory that should not
==		be part of the reply.
==
===========================================================

===========
Description
===========

All versions of Samba from 4.0.0 to 4.3.2 inclusive (resp. all
ldb versions up to 1.1.23 inclusive) are vulnerable to
a remote memory read attack in the samba daemon LDAP server.

A malicious client can send packets that cause the LDAP server in the
samba daemon process to return heap memory beyond the length of the
requested value.

This memory may contain data that the client should not be allowed to
see, allowing compromise of the server.

The memory may either be returned to the client in an error string, or
stored in the database by a suitabily privileged user.  If untrusted
users can create objects in your database, please confirm that all DN
and name attributes are reasonable.  (A script to assist in this
search will be put in the wiki or bugzilla).


==================
Patch Availability
==================

Patches addressing this defect have been posted to

 https://www.samba.org/samba/history/security.html

Additionally, Samba 4.3.3, 4.2.7 and 4.1.22 (resp. ldb 1.1.24)
have been issued as security releases to correct the defect.
Samba vendors and administrators running affected versions are
advised to upgrade or apply the patch as soon as possible.

==========
Workaround
==========

None.

=======
Credits
=======

This problem was found by Douglas Bagnall
 of Catalyst (www.catalyst.net.nz),
who also provided the fix.
Comment 17 Bernhard Wiedemann 2015-12-16 17:00:57 UTC 
This is an autogenerated message for OBS integration:
This bug (958586) was mentioned in
https://build.opensuse.org/request/show/349211 Factory / samba
Comment 18 Swamp Workflow Management 2015-12-18 20:15:10 UTC 
SUSE-SU-2015:2304-1: An update that solves 6 vulnerabilities and has 17 fixes is now available.

Category: security (important)
Bug References: 295284,773464,872912,901813,902421,910378,912457,913304,923374,931854,936909,939051,947552,949022,951660,953382,954658,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-8467
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    ldb-1.1.24-4.3.1, samba-4.1.12-18.3.1, talloc-2.1.5-3.4.1, tdb-1.3.8-2.3.1, tevent-0.9.26-3.3.1
SUSE Linux Enterprise Server 12 (src):    ldb-1.1.24-4.3.1, samba-4.1.12-18.3.1, talloc-2.1.5-3.4.1, tdb-1.3.8-2.3.1, tevent-0.9.26-3.3.1
SUSE Linux Enterprise Desktop 12 (src):    ldb-1.1.24-4.3.1, samba-4.1.12-18.3.1, talloc-2.1.5-3.4.1, tdb-1.3.8-2.3.1, tevent-0.9.26-3.3.1
Comment 19 Swamp Workflow Management 2015-12-18 21:12:43 UTC 
SUSE-SU-2015:2305-1: An update that solves 6 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 949022,951660,954658,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-8467
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    ldb-1.1.24-4.1, samba-4.2.4-6.1, talloc-2.1.5-4.1, tdb-1.3.8-4.1, tevent-0.9.26-4.1
SUSE Linux Enterprise Server 12-SP1 (src):    ldb-1.1.24-4.1, samba-4.2.4-6.1, talloc-2.1.5-4.1, tdb-1.3.8-4.1, tevent-0.9.26-4.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    ldb-1.1.24-4.1, samba-4.2.4-6.1, talloc-2.1.5-4.1, tdb-1.3.8-4.1, tevent-0.9.26-4.1
Comment 20 James McDonough 2015-12-23 22:22:28 UTC 
note this only affects the AD DC, which we do not ship
Comment 21 Swamp Workflow Management 2015-12-24 02:12:32 UTC 
openSUSE-SU-2015:2354-1: An update that solves 6 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 949022,951660,954658,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-8467
Sources used:
openSUSE Leap 42.1 (src):    ldb-1.1.24-7.1, samba-4.2.4-9.2, talloc-2.1.5-7.1, tdb-1.3.8-7.1, tevent-0.9.26-7.1
Comment 22 Swamp Workflow Management 2015-12-24 15:13:02 UTC 
openSUSE-SU-2015:2356-1: An update that solves 7 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 939050,939051,949022,951660,953382,954658,958580,958581,958582,958583,958584,958585,958586
CVE References: CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-7540,CVE-2015-8467
Sources used:
openSUSE 13.2 (src):    ldb-1.1.24-3.4.1, samba-4.1.22-21.1, talloc-2.1.5-2.6.1, tdb-1.3.8-3.1, tevent-0.9.26-3.1
openSUSE 13.1 (src):    ldb-1.1.24-3.7.1, samba-4.1.22-3.46.1, talloc-2.1.5-7.10.1, tdb-1.3.8-4.7.1, tevent-0.9.26-4.7.1
Comment 23 Swamp Workflow Management 2016-01-05 19:17:19 UTC 
SUSE-SU-2016:0032-1: An update that solves four vulnerabilities and has 8 fixes is now available.

Category: security (important)
Bug References: 295284,773464,901813,912457,913304,934299,948244,949022,958582,958583,958584,958586
CVE References: CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330
Sources used:
SUSE Linux Enterprise Server 11-SP2-LTSS (src):    samba-3.6.3-45.2, samba-doc-3.6.3-45.2
SUSE Linux Enterprise Debuginfo 11-SP2 (src):    samba-3.6.3-45.2
Comment 24 Marcus Meissner 2016-01-11 13:04:14 UTC 
done i think
Comment 27 Swamp Workflow Management 2016-01-19 12:14:50 UTC 
SUSE-SU-2016:0164-1: An update that solves four vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 295284,912457,934299,936909,948244,949022,953382,958582,958583,958584,958586
CVE References: CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    samba-3.6.3-64.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    samba-3.6.3-64.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Server 11-SP4 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Server 11-SP3 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    samba-3.6.3-64.1, samba-doc-3.6.3-64.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    samba-3.6.3-64.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    samba-3.6.3-64.1
Comment 28 Swamp Workflow Management 2016-04-17 13:15:24 UTC 
openSUSE-SU-2016:1064-1: An update that solves 16 vulnerabilities and has 17 fixes is now available.

Category: security (important)
Bug References: 898031,901813,912457,913238,913547,914279,917376,919309,924519,936862,942716,946051,947552,949022,958581,958582,958583,958584,958585,958586,964023,966271,968222,968973,971965,972197,973031,973032,973033,973034,973036,973832,974629
CVE References: CVE-2014-8143,CVE-2015-0240,CVE-2015-3223,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2015-8467,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE 13.2 (src):    samba-4.2.4-34.1
Comment 29 Swamp Workflow Management 2016-04-20 10:09:37 UTC 
openSUSE-SU-2016:1106-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 844720,849224,853347,917376,936862,958582,958583,958584,958586,968222,971965,973031,973032,973033,973034,973035,973036
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4496,CVE-2015-0240,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2114,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE 13.1 (src):    samba-4.2.4-3.54.2
Comment 30 Swamp Workflow Management 2016-04-20 10:12:46 UTC 
openSUSE-SU-2016:1107-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 844720,849224,853347,917376,936862,958582,958583,958584,958586,968222,971965,973031,973032,973033,973034,973035,973036
CVE References: CVE-2012-6150,CVE-2013-4408,CVE-2013-4496,CVE-2015-0240,CVE-2015-5252,CVE-2015-5296,CVE-2015-5299,CVE-2015-5330,CVE-2015-5370,CVE-2015-7560,CVE-2016-2110,CVE-2016-2111,CVE-2016-2112,CVE-2016-2113,CVE-2016-2114,CVE-2016-2115,CVE-2016-2118
Sources used:
openSUSE Evergreen 11.4 (src):    samba-3.6.3-141.1, samba-doc-3.6.3-141.1