CVE-2022-0336: Incorrect Default Permissions (CWE-276)
value: The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 8.8
Published: 2022-08-29T15:15Z
Repository: https://github.com/samba-team/samba
Language: Other
Files changed: python/samba/tests/ldap_spn.py, selftest/knownfail.d/ldap_spn
Commit date: 2022-01-31 15:27:37 +0000
Commit message: CVE-2022-0336: pytest: Add a test for an SPN conflict with a re-added SPN

This test currently fails, as re-adding an SPN means that later checks
do not run.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Diff: diff --git a/python/samba/tests/ldap_spn.py b/python/samba/tests/ldap_spn.py
index 8a398ffaa4..6ebdf8f9a3 100644
--- a/python/samba/tests/ldap_spn.py
+++ b/python/samba/tests/ldap_spn.py
@@ -266,10 +266,12 @@ class LdapSpnTestBase(TestCase):
                                  "Casefold typo?")
 
             for k in ('dNSHostName', 'servicePrincipalName'):
                 if isinstance(m.get(k), str):
                     m[k] = m[k].format(dnsname=f"x.{REALM}")
+                elif isinstance(m.get(k), list):
+                    m[k] = [x.format(dnsname=f"x.{REALM}") for x in m[k]]
 
             msg = ldb.Message.from_dict(samdb, m, op)
 
             if expected is bad:
                 try:
@@ -725,10 +727,15 @@ class LdapSpnSambaOnlyTest(LdapSpnTestBase):
         ),
         ("add a conflict, host first both on user, service rights",
          ('user:C', 'host/{dnsname}', '*', ok),
          ('user:D', 'www/{dnsname}', 'D', denied),
         ),
+        ("add a conflict, along with a re-added SPN",
+         ('A', 'cifs/{dnsname}', '*', ok),
+         ('B', 'cifs/heeble.example.net', 'B', ok),
+         ('B', ['cifs/heeble.example.net', 'host/{dnsname}'], 'B', constraint),
+        ),
 
         ("changing dNSHostName after host",
          ('A', {'dNSHostName': '{dnsname}'}, '*', ok),
          ('A', 'host/{dnsname}', '*', ok),
          ('A', {'dNSHostName': 'y.{dnsname}'}, '*', ok),
diff --git a/selftest/knownfail.d/ldap_spn b/selftest/knownfail.d/ldap_spn
index 63f9fe02ef..16dafa91b6 100644
--- a/selftest/knownfail.d/ldap_spn
+++ b/selftest/knownfail.d/ldap_spn
@@ -1 +1,2 @@
 samba.tests.ldap_spn.+LdapSpnTest.test_spn_dodgy_spns
+samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN

Fixed code:                 elif isinstance(m.get(k), list):
                    m[k] = [x.format(dnsname=f"x.{REALM}") for x in m[k]]
        ("add a conflict, along with a re-added SPN",
         ('A', 'cifs/{dnsname}', '*', ok),
         ('B', 'cifs/heeble.example.net', 'B', ok),
         ('B', ['cifs/heeble.example.net', 'host/{dnsname}'], 'B', constraint),
        ),
samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN