Headline
CVE-2020-25718: Samba - Security Announcement Archive
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
CVE-2020-25718.html:
=========================================================== == Subject: Samba AD DC did not correctly sandbox == Kerberos tickets issued by an RODC. == == CVE ID#: CVE-2020-25718 == == Versions: Samba 4.0.0 and later == == Summary: The Samba AD DC, when joined by an RODC, did == not confirm if the RODC was allowed to print a == ticket for that user. ===========================================================
=========== Description ===========
Samba as an Active Directory Domain Controller is able to support an RODC, which is meant to have minimal privileges in a domain.
However, in accepting a ticket from a Samba or Windows RODC, Samba was not confirming that the RODC is authorized to print such a ticket, via the msDS-NeverRevealGroup and msDS-RevealOnDemandGroup (typically “Allowed RODC Replication Group” and “Denied RODC Replciation Group”).
This would allow an RODC to print administrator tickets.
================== Patch Availability ==================
Patches addressing both these issues have been posted to:
https://www.samba.org/samba/security/
Additionally, Samba 4.15.2, 4.14.10 and 4.13.14 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible.
================== CVSSv3 calculation ==================
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5)
========== Workaround ==========
======= Credits =======
Originally reported by Andrew Bartlett.
Patches provided by:
- Andrew Bartlett of Catalyst and the Samba Team.
- Douglas Bagnall of Catalyst and the Samba Team.
- Joseph Sutton of Catalyst and the Samba Team
Catalyst wishes to thank Univention Gmbh in particular for their support towards the production of this fix.
Advisory written by Andrew Bartlett of Catalyst
========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ==========================================================
Related news
Gentoo Linux Security Advisory 202309-6 - Multiple vulnerabilities have been discovered in Samba, the worst of which could result in root remote code execution. Versions greater than or equal to 4.18.4 are affected.
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.