CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via...
authorGünther Deschner <gd@samba.org>
Tue, 13 Mar 2018 15:56:20 +0000 (16:56 +0100)
committerKarolin Seeger <kseeger@samba.org>
Sat, 11 Aug 2018 06:16:03 +0000 (08:16 +0200)
This fixes a regression that came in via 00db3aba6cf9ebaafdf39ee2f9c7ba5ec2281ea0.

Found by Vivek Das <vdas@redhat.com> (Red Hat QE).

In order to demonstrate simply run:

smbclient //server/share -U user%password -mNT1 -c quit \
--option="client ntlmv2 auth"=no \
--option="client use spnego"=no

against a server that uses "ntlm auth = ntlmv2-only" (our default
setting).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

CVE-2018-1139: Weak authentication protocol allowed.

Guenther

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
libcli/auth/ntlm_check.c
selftest/knownfail
selftest/knownfail.d/ntlm [deleted file]

index 1c6499bd21087f6acc7b00352e72a545c52a74fe..b68e9c878885096e768fe34f62a39a5aa1c63974 100644 (file)
@@ -572,7 +572,7 @@ NTSTATUS ntlm_password_check(TALLOC_CTX *mem_ctx,
           - I think this is related to Win9X pass-though authentication
        */
        DEBUG(4,("ntlm_password_check: Checking NT MD4 password in LM field\n"));
-       if (ntlm_auth) {
+       if (ntlm_auth == NTLM_AUTH_ON) {
                if (smb_pwd_check_ntlmv1(mem_ctx, 
                                         lm_response, 
                                         stored_nt->hash, challenge,
index eaddaece25cf9d215978cabc511329222cecf8bb..5790f4c205c49b929cc0c540e341bb499b4288e3 100644 (file)
 ^samba4.smb.signing.*disabled.*signing=off.*\(ad_dc\)
 # fl2000dc doesn't support AES
 ^samba4.krb5.kdc.*as-req-aes.*fl2000dc
-# nt4_member and ad_member don't support ntlmv1
+# nt4_member and ad_member don't support ntlmv1 (not even over SMB1)
 ^samba3.blackbox.smbclient_auth.plain.*_member.*option=clientntlmv2auth=no.member.creds.*as.user
+^samba3.blackbox.smbclient_auth.plain.*_member.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user
 #nt-vfs server blocks read with execute access
 ^samba4.smb2.read.access
 #ntvfs server blocks copychunk with execute access on read handle
diff --git a/selftest/knownfail.d/ntlm b/selftest/knownfail.d/ntlm
deleted file mode 100644 (file)
index c6e6a37..0000000
+++ /dev/null
@@ -1,2 +0,0 @@
-^samba.unittests.ntlm_check.test_ntlm_mschapv2_only_denied
-^samba.unittests.ntlm_check.test_ntlmv2_only_ntlm\(