kcmdump

KCM dumper SSSD에서 사용하는 KCM 데이터베이스를 덤프하고 CCACHE 형식의 Kerberos 티켓을 복구하는 간단한 스크립트입니다. 처음에는 SSSDKCMExtractor와 KCMTicketFormatter를 기반으로 합니다. 설명 버전 2.0.02018-08-13부터 SSSD의 KCM 응답자의 백엔드 저장소는 더 이상 데이터베이스 콘텐츠를 암호화하지 않습니다. 그러나 여전히 LDB 데이터베이스그 자체는 TDB 기반에 의존하므로 LDAP 유사 쿼리를 사용하여 쉽게 검색할 수 있습니다. SSSD는 Kerberos...

In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared the user credentials state was only pointed at and when one connection within that association group ended the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.

...

CVE-2016-2123: Heap-based Buffer Overflow

A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndrpulldnspname contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndrpulldnspname parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute ov...

CVE-2018-10918

A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable...

CVE-2018-10918: NULL Pointer Dereference

A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable...