Twenty Year Anniversary

Samba 4.x Password Change

Samba 4.x Password Change
Posted Mar 14, 2018
Authored by Bjorn Baumbach | Site samba.org

On a Samba 4 AD DC any authenticated user can change other users' passwords over LDAP, including the passwords of administrative users and service accounts.

tags | advisory
advisories | CVE-2018-1057
MD5 | 3b6810bd48be05c7a1e4a015732305ed

Samba 4.x Password Change

Change Mirror Download
====================================================================
== Subject: Authenticated users can change other users' password
==
== CVE ID#: CVE-2018-1057
==
== Versions: All versions of Samba from 4.0.0 onwards.
==
== Summary: On a Samba 4 AD DC any authenticated user can change
== other users' passwords over LDAP, including the
== passwords of administrative users and service
== accounts.
==
====================================================================

===========
Description
===========

On a Samba 4 AD DC the LDAP server in all versions of Samba from
4.0.0 onwards incorrectly validates permissions to modify passwords
over LDAP allowing authenticated users to change any other users'
passwords, including administrative users and privileged service
accounts (eg Domain Controllers).

The LDAP server incorrectly validates certain LDAP password
modifications against the "Change Password" privilege, but then
performs a password reset operation.

The change password right in AD is an extended object access right
with the GUID ab721a53-1e2f-11d0-9819-00aa0040529b.

By default user objects grant the change password right to the
authenticated user's own user object (self) and to everyone
(world). Computer objects grant the change password right to
everyone.

The corresponding ACEs expressed in SDDL are

self: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)
world: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)

The components of these ACEs are

OA: object access allowed
CR: extended rights
PS: trustee: self
WD: trustee: world/everyone

The problematic ACE is the one for world/everyone.

The Windows GUI shows this as "Change password" right granted to
"Everyone".

==========
Workaround
==========

Possible workarounds are described at a dedicated page in the Samba wiki:

https://wiki.samba.org/index.php/CVE-2018-1057

==================
Patch Availability
==================

A patch addressing this defect has been posted to

https://www.samba.org/samba/security/

Additionally, Samba 4.7.6, 4.6.14 and 4.5.16 have been issued as
security releases to correct the defect. Patches against older Samba
versions may be available at https://samba.org/samba/patches/. Samba
vendors and administrators running affected versions are advised to
upgrade or apply the patch as soon as possible.

=======
Credits
=======

This problem was found by BjAPrn Baumbach from SerNet. Ralph BAPhme and
Stefan Metzmacher from SerNet and the Samba Team provided the fix.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close