SAMBA+ 4.19.3-5 and SAMBA+ 4.18.9-9 have just been released by SerNet's Samba team. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX are available now.
Please see the release history here:
The fix for CVE-2018-14628, which is now part of the upstream 4.19.3 and 4.18.9 releases was already fixed in SAMBA+ 4.19.2 and SAMBA+ 4.18.8. For completeness we describe once more how to apply the actual fix for the AD database. If you did that already along with the previous SAMBA+ update, then you don't have to do the following steps again.
Action required in order to resolve CVE-2018-14628
The patched Samba does NOT protect existing domains!
The administrator needs to run the following command (on only one domain controller) in order to apply the protection to an existing domain:
samba-tool dbcheck --cross-ncs --attrs=nTSecurityDescriptor --fix
The above requires manual interaction in order to review the changes before they are applied. Typicall question look like this:
Reset nTSecurityDescriptor on CN=Deleted Objects,DC=samba,DC=org back to provision default?
Owner mismatch: SY (in ref) DA(in current)
Group mismatch: SY (in ref) DA(in current)
Part dacl is different between reference and current here is the detail:
(A;;LCRPLORC;;;AU) ACE is not present in the reference
(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) ACE is not present in the reference
(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA) ACE is not present in the reference
(A;;CCDCLCSWRPWPSDRCWDWO;;;SY) ACE is not present in the current
(A;;LCRP;;;BA) ACE is not present in the current
[y/N/all/none] y
Fixed attribute 'nTSecurityDescriptor' of 'CN=Deleted Objects,DC=samba,DC=org' The change should be confirmed with 'y' for all objects starting with
'CN=Deleted Objects'.
