Allele Security Intelligence

ASA-2019-00622 – Samba: User with “get changes” permission can crash AD DC LDAP server via dirsync

Posted on October 31, 2019November 5, 2019 by Allele Security Intelligence in Alerts

Since Samba 4.0.0 Samba has implemented, in the AD DC, the "dirsync" LDAP control specified in MS-ADTS "3.1.1.3.4.1.3 LDAP_SERVER_DIRSYNC_OID". However, when combined with the ranged results feature specified in MS-ADTS "3.1.1.3.1.3.3 Range Retrieval of Attribute Values" a NULL pointer is can be de-referenced. This is a Denial of Service only, no further escalation of privilege is associated with this issue.

ASA-2019-00364 – Samba: A user with read access to the directory can cause a NULL pointer dereference using the paged search control

Posted on June 20, 2019October 31, 2019 by Allele Security Intelligence in Alerts

A user with read access to the LDAP server can crash the LDAP server process. Depending on the Samba version and the choice of process model, this may crash only the user's own connection.