RHSA-2017:1265MediumCVSS 6.4

Red Hat Security Advisory: samba security and bug fix update

Published
May 22, 2017
Last Modified
November 5, 2026

🔗 CVE IDs covered (3)

CVE-2017-2619 →CVE-2016-2125 →CVE-2016-2126 →

📋 Description

CVE-2016-2125 — samba: Unconditional privilege delegation to Kerberos servers in trusted realms CVE-2016-2126 — samba: Flaws in Kerberos PAC validation can trigger privilege elevation CVE-2017-2619 — samba: symlink race permits opening files outside share directory

🎯 Affected products200

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Server Resilient Storage (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • ctdb-0:4.4.4-13.el7_3.x86_64 as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)
  • ctdb-tests-0:4.4.4-13.el7_3.x86_64 as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux Client (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.ppc as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.s390 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • libsmbclient-0:4.4.4-13.el7_3.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • libsmbclient-devel-0:4.4.4-13.el7_3.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • libsmbclient-devel-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • libsmbclient-devel-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • libsmbclient-devel-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • libsmbclient-devel-0:4.4.4-13.el7_3.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the smb service will be restarted automatically. Workaround: The following mitigation is suggested by upstream. The samba-tool command and the AD DC mode honours the undocumented "gensec_gssapi:delegation=no" option in the [global] section of the smb.conf file. Controlling Kerberos forwarding =============================== In the Active Directory world it's possible for administrators to limit the delegation. User and computer objects can both act as Kerberos users and also as Kerberos services. Both types of objects have an attribute called 'userAccountControl' which is a bitmask that controls the behavior of the account. The following three values have impact on possible delegation: 0x00100000: UF_NOT_DELEGATED: The UF_NOT_DELEGATED can be used to disable the ability to get forwardable TGT for the account. It means the KDC will respond with an error if the client asks for the forwardable ticket. The client typically gives up and removes the GSS_C_DELEG_FLAG flag and continues without passing delegated credentials. Administrators can use this to disable possible delegation for the most privileged accounts (e.g. administrator accounts). 0x00080000: UF_TRUSTED_FOR_DELEGATION If the UF_TRUSTED_FOR_DELEGATION is set on an account a KDC will include the OK_AS_DELEGATE flag in a granted service ticket. If the client application uses just GSS_C_DELEG_POLICY_FLAG (instead of GSS_C_DELEG_FLAG) gssapi/Kerberos libraries typically only include delegated credentials when the service ticket includes the OK_AS_DELEGATE flag. Administrators can use this to control which services will get delegated credentials, for example if the service runs in a trusted environment and actually requires the presence of delegated credentials. 0x01000000: UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION The UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION is not really relevant for this CVE and just listed here for completeness. This flag is relevant for the S4U2Proxy feature, where a service can ask the KDC for a proxied service ticket which can impersonate users to other services. Workaround: Add the parameter: unix extensions = no to the [global] section of your smb.conf and restart smbd. This prevents SMB1 clients from creating symlinks on the exported file system using SMB1. However, if the same region of the file system is also exported using NFS, NFS clients can create symlinks that potentially can also hit the race condition. For non-patched versions of Samba we recommend only exporting areas of the file system by either SMB or NFS, not both.

🔗 References (6)