A samba security update has been released for Debian GNU/Linux 11.

DSA 5003-1: samba security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5003-1 security@debian.org
  https://www.debian.org/security/ Salvatore Bonaccorso
November 09, 2021   https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : samba
CVE ID : CVE-2016-2124 CVE-2020-25717 CVE-2020-25718 CVE-2020-25719
CVE-2020-25721 CVE-2020-25722 CVE-2021-3738 CVE-2021-23192

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix.

CVE-2016-2124

Stefan Metzmacher reported that SMB1 client connections can be
downgraded to plaintext authentication.

CVE-2020-25717

Andrew Bartlett reported that Samba may map domain users to local
users in an undesired way, allowing for privilege escalation. The
update introduces a new parameter "min domain uid" (default to 1000)
to not accept a UNIX uid below this value.

CVE-2020-25718

Andrew Bartlett reported that Samba as AD DC, when joined by an
RODC, did not confirm if the RODC was allowed to print a ticket for
that user, allowing an RODC to print administrator tickets.

CVE-2020-25719

Andrew Bartlett reported that Samba as AD DC, did not always rely on
the SID and PAC in Kerberos tickets and could be confused about the
user a ticket represents. If a privileged account was attacked this
could lead to total domain compromise.

CVE-2020-25721

Andrew Bartlett reported that Samba as a AD DC did not provide a way
for Linux applications to obtain a reliable SID (and samAccountName)
in issued tickets.

CVE-2020-25722

Andrew Bartlett reported that Samba as AD DC did not do sufficient
access and conformance checking of data stored, potentially allowing
total domain compromise.

CVE-2021-3738

William Ross reported that the Samba AD DC RPC server can use memory
that was free'd when a sub-connection is closed, resulting in denial
of service, and potentially, escalation of privileges.

CVE-2021-23192

Stefan Metzmacher reported that if a client to a Samba server sent a
very large DCE/RPC request, and chose to fragment it, an attacker
could replace later fragments with their own data, bypassing the
signature requirements.

For the stable distribution (bullseye), these problems have been fixed in
version 2:4.13.13+dfsg-1~deb11u2.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to its security
tracker page at:
  https://security-tracker.debian.org/tracker/samba

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://www.debian.org/security/