samba.git/libcli, branch v4-7-stable

CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth".

2018-08-11T19:56:43+00:00

This fixes a regression that came in via 00db3aba6cf9ebaafdf39ee2f9c7ba5ec2281ea0.

Found by Vivek Das  (Red Hat QE).

In order to demonstrate simply run:

smbclient //server/share -U user%password -mNT1 -c quit \
--option="client ntlmv2 auth"=no \
--option="client use spnego"=no

against a server that uses "ntlm auth = ntlmv2-only" (our default
setting).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

CVE-2018-1139: Weak authentication protocol allowed.

Guenther

Pair-Programmed-With: Stefan Metzmacher 
Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider

CVE-2018-1139 libcli/auth: fix debug messages in hash_password_check()

2018-08-11T19:56:42+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

CVE-2018-1139: Weak authentication protocol allowed.

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider

CVE-2018-1139 libcli/auth: Add initial tests for ntlm_password_check()

2018-08-11T19:56:42+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

Signed-off-by: Andrew Bartlett

CVE-2018-10919 security: Fix checking of object-specific CONTROL_ACCESS rights

2018-08-11T19:56:41+00:00

An 'Object Access Allowed' ACE that assigned 'Control Access' (CR)
rights to a specific attribute would not actually grant access.

What was happening was the remaining_access mask for the object_tree
nodes would be Read Property (RP) + Control Access (CR). The ACE mapped
to the schemaIDGUID for a given attribute, which would end up being a
child node in the tree. So the CR bit was cleared for a child node, but
not the rest of the tree. We would then check the user had the RP access
right, which it did. However, the RP right was cleared for another node
in the tree, which still had the CR bit set in its remaining_access
bitmap, so Samba would not grant access.

Generally, the remaining_access only ever has one bit set, which means
this isn't a problem normally. However, in the Control Access case there
are 2 separate bits being checked, i.e. RP + CR.

One option to fix this problem would be to clear the remaining_access
for the tree instead of just the node. However, the Windows spec is
actually pretty clear on this: if the ACE has a CR right present, then
you can stop any further access checks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434

Signed-off-by: Tim Beale

CVE-2018-10919 security: Add more comments to the object-specific access checks

2018-08-11T19:56:41+00:00

Reading the spec and then reading the code makes sense, but we could
comment the code more so it makes sense on its own.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434

Signed-off-by: Tim Beale

CVE-2018-10919 security: Move object-specific access checks into separate function

2018-08-11T19:56:41+00:00

Object-specific access checks refer to a specific section of the
MS-ADTS, and the code closely matches the spec. We need to extend this
logic to properly handle the Control-Access Right (CR), so it makes
sense to split the logic out into its own function.

This patch just moves the code, and should not alter the logic (apart
from ading in the boolean grant_access return variable.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434

Signed-off-by: Tim Beale

libsmb: Handle long-running smb2cli_notify

2018-04-20T09:53:10+00:00

This likely runs into a timeout. Properly cancel the smb2 request,
allowing the higher-level caller to re-issue this request on an existing
handle.

I did not see a proper way to achieve this with tevent_req_set_endtime or
something like that.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13382
Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison 
(cherry picked from commit 91c0f497816bb88d8935a8a79c146c08379ecf53)

libsmb: Add smb2cli_notify()

2018-04-20T09:53:09+00:00

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13382
Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison 
(cherry picked from commit ad33964f8c85b67a2d2b451bece208d8bfb8cad6)

libcli/security: only announce a session as GUEST if 'Builtin\Guests' is there without 'Authenticated User'

2018-03-20T16:13:07+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13328

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme 
(cherry picked from commit f564847c8e9d31fe07dd3cbf435986b36f097fa3)

smbXcli: Add "force_channel_sequence"

2018-03-08T12:34:30+00:00

This enables use of the channel sequence number even for
non-multi-channel servers. This makes our client invalid, but we need to
protect against broken clients with tests.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13215

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher 
(cherry picked from commit cd288a08500b1cc38ef26e5cb8ef754b4da658b6)