CVE-2016-2125

Description

It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

Mitigation

The following mitigation is suggested by upstream.

The samba-tool command and the AD DC mode honours the undocumented "gensec_gssapi:delegation=no" option in the [global] section of the smb.conf file.

Controlling Kerberos forwarding
===============================

In the Active Directory world it's possible for administrators to
limit the delegation. User and computer objects can both act as
Kerberos users and also as Kerberos services. Both types of objects have an
attribute called 'userAccountControl' which is a bitmask that controls the
behavior of the account. The following three values have impact on possible
delegation:

0x00100000: UF_NOT_DELEGATED:

The UF_NOT_DELEGATED can be used to disable the ability to get forwardable TGT
for the account. It means the KDC will respond with an error if the client asks
for the forwardable ticket. The client typically gives up and removes the
GSS_C_DELEG_FLAG flag and continues without passing delegated credentials.
Administrators can use this to disable possible delegation for the most
privileged accounts (e.g. administrator accounts).

0x00080000: UF_TRUSTED_FOR_DELEGATION

If the UF_TRUSTED_FOR_DELEGATION is set on an account a KDC will include the
OK_AS_DELEGATE flag in a granted service ticket. If the client application
uses just GSS_C_DELEG_POLICY_FLAG (instead of GSS_C_DELEG_FLAG) gssapi/Kerberos
libraries typically only include delegated credentials when the service ticket
includes the OK_AS_DELEGATE flag. Administrators can use this to control which
services will get delegated credentials, for example if the service runs in a
trusted environment and actually requires the presence of delegated
credentials.

0x01000000: UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION

The UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION is not really relevant for this
CVE and just listed here for completeness. This flag is relevant for the
S4U2Proxy feature, where a service can ask the KDC for a proxied service
ticket which can impersonate users to other services.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score6.46.56.4
Attack VectorAdjacent NetworkAdjacent NetworkAdjacent Network
Attack ComplexityHighLowHigh
Privileges RequiredNoneNoneNone
User InteractionRequiredNoneRequired
ScopeUnchangedUnchangedUnchanged
ConfidentialityHighHighHigh
Integrity ImpactHighNoneHigh
Availability ImpactNoneNoneNone

Vector

Red Hat: CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

NVD: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

cve.org: CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Understanding the Weakness (CWE)

CWE-287

Integrity,Confidentiality,Availability,Access Control

Technical Impact: Read Application Data; Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.