CVE-2022-0336 (published 2022-08-29T15:15Z)

The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/samba-team/samba
commit_details: repo_url: https://github.com/samba-team/samba
author: Joseph Sutton
author_date: 2022-01-18 12:02:45+13:00
msg: CVE-2022-0336: s4/dsdb/samldb: Don't return early when an SPN is re-added to an object

If an added SPN already exists on an object, we still want to check the
rest of the element values for conflicts.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
repository: repo_url: https://github.com/samba-team/samba
repo_name: samba-team/samba
description: https://gitlab.com/samba-team/samba is the Official GitLab mirror of https://git.samba.org/samba.git   --   Merge requests should be made on GitLab (not on GitHub)
repo_language: C
owner: samba-team
file_changes: filename: ldap_spn
change_type: ModificationType.MODIFY
diff: @@ -1,2 +1 @@
 samba.tests.ldap_spn.+LdapSpnTest.test_spn_dodgy_spns
-samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN

programming_language: Markdown
filename: samldb.c
change_type: ModificationType.MODIFY
diff: @@ -4006,8 +4006,7 @@ static int samldb_spn_uniqueness_check(struct samldb_ctx *ac,
 						 ac->msg->dn);
 		if (ret == LDB_ERR_COMPARE_TRUE) {
 			DBG_INFO("SPN %s re-added to the same object\n", spn);
-			talloc_free(tmp_ctx);
-			return LDB_SUCCESS;
+			continue;
 		}
 		if (ret != LDB_SUCCESS) {
 			DBG_ERR("SPN %s failed direct uniqueness check\n", spn);

programming_language: C
repo_url: https://github.com/samba-team/samba
commit_details: repo_url: https://github.com/samba-team/samba
author: Joseph Sutton
author_date: 2022-01-18 11:56:38+13:00
msg: CVE-2022-0336: pytest: Add a test for an SPN conflict with a re-added SPN

This test currently fails, as re-adding an SPN means that later checks
do not run.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
repository: repo_url: https://github.com/samba-team/samba
repo_name: samba-team/samba
description: https://gitlab.com/samba-team/samba is the Official GitLab mirror of https://git.samba.org/samba.git   --   Merge requests should be made on GitLab (not on GitHub)
repo_language: C
owner: samba-team
file_changes: filename: ldap_spn.py
change_type: ModificationType.MODIFY
diff: @@ -268,6 +268,8 @@ class LdapSpnTestBase(TestCase):
             for k in ('dNSHostName', 'servicePrincipalName'):
                 if isinstance(m.get(k), str):
                     m[k] = m[k].format(dnsname=f"x.{REALM}")
+                elif isinstance(m.get(k), list):
+                    m[k] = [x.format(dnsname=f"x.{REALM}") for x in m[k]]
 
             msg = ldb.Message.from_dict(samdb, m, op)
 
@@ -727,6 +729,11 @@ class LdapSpnSambaOnlyTest(LdapSpnTestBase):
          ('user:C', 'host/{dnsname}', '*', ok),
          ('user:D', 'www/{dnsname}', 'D', denied),
         ),
+        ("add a conflict, along with a re-added SPN",
+         ('A', 'cifs/{dnsname}', '*', ok),
+         ('B', 'cifs/heeble.example.net', 'B', ok),
+         ('B', ['cifs/heeble.example.net', 'host/{dnsname}'], 'B', constraint),
+        ),
 
         ("changing dNSHostName after host",
          ('A', {'dNSHostName': '{dnsname}'}, '*', ok),

programming_language: Python
filename: ldap_spn
change_type: ModificationType.MODIFY
diff: @@ -1 +1,2 @@
 samba.tests.ldap_spn.+LdapSpnTest.test_spn_dodgy_spns
+samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN

programming_language: Markdown