JARVIS
Die Entwickler der Open-Source Software für Datei- und Druckerdienste, haben einen security Patch herausgebracht. Dieser betrifft alle Installationen die Kerberos mit Heimdal verwenden. Ein Angreifer könnte so Zugriff auf die Domain und Daten erhalten.
Samba CVE-2017-11103 Release Notes
== Versions: All versions of Samba from 4.0.0 onwards using
== embedded Heimdal Kerberos.
==
== Samba binaries built against MIT Kerberos are not
== vulnerable.
==
== Summary: A MITM attacker may impersonate a trusted server
== and thus gain elevated access to the domain by
== returning malicious replication or authorization data.
==
====================================================================
===========
Description
===========
All versions of Samba from 4.0.0 include an embedded copy of Heimdal
Kerberos. Heimdal has made a security release, which disclosed:
Fix CVE-2017-11103: Orpheus’ Lyre KDC-REP service name validation
This is a critical vulnerability.
In _krb5_extract_ticket() the KDC-REP service name must be obtained from
encrypted version stored in ‘enc_part’ instead of the unencrypted version
stored in ‘ticket’. Use of the unecrypted version provides an
opportunity for successful server impersonation and other attacks.
Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
See https://www.orpheus-lyre.info/ for more details.
The impact for Samba is particularly strong for cases where the Samba
DRS replication service contacts another DC requesting replication
of user passwords, as these could then be controlled by the attacker.
==================
Patch Availability
==================
A patch addressing this defect has been posted to
https://www.samba.org/samba/security/
Additionally, Samba 4.6.6, 4.5.12 and 4.4.15 have been issued as security
releases to correct the defect. Samba vendors and administrators running
affected versions linked against the embedded Heimdal Kerberos are advised to
upgrade or apply the patch as soon as possible.
==========
Workaround
==========
Samba versions built against MIT Kerberos are not impacted. Unless
you are running Samba as an AD DC, then rebuild samba using:
./configure –with-system-mitkrb5.
=======
Credits
=======
This problem was identified in Heimdal by Jeffrey Altman, Viktor
Duchovni and Nico Williams.
Andrew Bartlett, Garming Sam and Bob Campbell of Catalyst and the
Samba Team ported the fix to Samba and wrote this advisory.
Interessiert in verschiedenste IT Themen, schreibe ich in diesem Blog über Software, Hardware, Smart Home, Games und vieles mehr. Ich berichte z.B. über die Installation und Konfiguration von Software als auch von Problemen mit dieser. News sind ebenso spannend, sodass ich auch über Updates, Releases und Neuigkeiten aus der IT berichte. Letztendlich nutze ich Taste-of-IT als eigene Dokumentation und Anlaufstelle bei wiederkehrenden Themen. Ich hoffe ich kann dich ebenso informieren und bei Problemen eine schnelle Lösung anbieten. Wer meinen Aufwand unterstützen möchte, kann gerne eine Tasse oder Pod Kaffe per PayPal spenden – vielen Dank.