Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1791207 (CVE-2019-14907)

Summary:	CVE-2019-14907 samba: Crash after failed character conversion at log level 3 or above
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abokovoy, anoopcs, asn, gdeschner, hvyas, iboukris, iboukris, jarrpa, jstephen, lmohanty, madam, puebele, rhs-smb, sbose, security-response-team, sisharma, ssorce, vbellur, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.11.5, samba 4.10.12, samba 4.9.18	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in samba. When log levels are set at 3 or higher, the string obtained from the client, after a failed character conversion, is printed which could cause long-lived processes to terminate. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-23 16:31:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1791208, 1791209, 1791662, 1793407
Bug Blocks:

Description Huzaifa S. Sidhpurwala 2020-01-15 08:50:33 UTC

As per upstream advisory:

If samba is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed.  Such strings can be provided during the NTLMSSP authentication exchange.

In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate.  (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

Comment 1 Huzaifa S. Sidhpurwala 2020-01-15 08:50:39 UTC

Acknowledgments:

Name: the Samba project
Upstream: Robert Święcki

Comment 2 Huzaifa S. Sidhpurwala 2020-01-15 08:50:43 UTC

Mitigation:

Do not set a log level of 3 or above in production.

Comment 5 Huzaifa S. Sidhpurwala 2020-01-21 10:02:08 UTC

External References:

https://www.samba.org/samba/security/CVE-2019-14907.html

Comment 6 Huzaifa S. Sidhpurwala 2020-01-21 10:03:11 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1793407]

Comment 7 errata-xmlrpc 2020-03-23 13:53:57 UTC

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.5 for RHEL 7

Via RHSA-2020:0943 https://access.redhat.com/errata/RHSA-2020:0943

Comment 8 Product Security DevOps Team 2020-03-23 16:31:58 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14907

Comment 9 errata-xmlrpc 2020-04-28 16:03:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1878 https://access.redhat.com/errata/RHSA-2020:1878

Comment 10 errata-xmlrpc 2020-09-29 20:19:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3981 https://access.redhat.com/errata/RHSA-2020:3981