CVE-2019-14870

Name	CVE-2019-14870
Description	All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	946786

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
heimdal (PTS)	stretch (security), stretch	7.1.0+dfsg-13+deb9u3	vulnerable
	buster	7.5.0+dfsg-3	vulnerable
	bullseye, sid	7.7.0+dfsg-2	fixed
samba (PTS)	stretch (security), stretch	2:4.5.16+dfsg-1+deb9u2	vulnerable
	buster	2:4.9.5+dfsg-5	vulnerable
	buster (security)	2:4.9.5+dfsg-5+deb10u1	vulnerable
	bullseye	2:4.11.5+dfsg-1	fixed
	sid	2:4.12.5+dfsg-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
heimdal	source	(unstable)	7.7.0+dfsg-1			946786
samba	source	(unstable)	2:4.11.3+dfsg-1

Notes

[buster] - samba <no-dsa> (Minor issue)
[stretch] - samba <no-dsa> (Minor issue)
[jessie] - samba <no-dsa> (Minor issue)
[buster] - heimdal <no-dsa> (Minor issue)
[stretch] - heimdal <no-dsa> (Minor issue)
[jessie] - heimdal <no-dsa> (Minor issue)
https://www.samba.org/samba/security/CVE-2019-14870.html
https://github.com/heimdal/heimdal/pull/663
https://github.com/heimdal/heimdal/pull/664 (port to 7.1 branch)