Bug 1192246 (CVE-2020-25718)

Summary: VUL-0: CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers
Product: [Novell Products] SUSE Security Incidents Reporter: Marcus Meissner <meissner>
Component: IncidentsAssignee: Novell Samba Team <samba>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium    
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: CVSSv3.1:SUSE:CVE-2020-25718:7.5:(AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Comment 1 Marcus Meissner 2021-11-02 12:27:41 UTC
CRD: 2021-11-09
Comment 5 Marcus Meissner 2021-11-10 07:57:59 UTC
i spublic


CVE-2020-25718.html:

===========================================================
== Subject:     Samba AD DC did not correctly sandbox
==              Kerberos tickets issued by an RODC.
==
== CVE ID#:     CVE-2020-25718
==
== Versions:    Samba 4.0.0 and later
==
== Summary:     The Samba AD DC, when joined by an RODC, did
==              not confirm if the RODC was allowed to print a
==              ticket for that user.
===========================================================

===========
Description
===========

Samba as an Active Directory Domain Controller is able to support an
RODC, which is meant to have minimal privileges in a domain.

However, in accepting a ticket from a Samba or Windows RODC, Samba
was not confirming that the RODC is authorized to print such a ticket,
via the msDS-NeverRevealGroup and msDS-RevealOnDemandGroup (typically
"Allowed RODC Replication Group" and "Denied RODC Replciation
Group").

This would allow an RODC to print administrator tickets.

==================
Patch Availability
==================

Patches addressing both these issues have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba  4.15.2, 4.14.10 and 4.13.14 have been issued
as security releases to correct the defect.  Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5)

==========
Workaround
==========


=======
Credits
=======

Originally reported by Andrew Bartlett.

Patches provided by:
 - Andrew Bartlett of Catalyst and the Samba Team.
 - Douglas Bagnall of Catalyst and the Samba Team.
 - Joseph Sutton of Catalyst and the Samba Team

Catalyst wishes to thank Univention Gmbh in particular for their
support towards the production of this fix.

Advisory written by Andrew Bartlett of Catalyst

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================
Comment 6 Swamp Workflow Management 2021-11-10 20:18:36 UTC
openSUSE-SU-2021:3647-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1014440,1192214,1192215,1192246,1192247,1192283,1192284,1192505
CVE References: CVE-2016-2124,CVE-2020-25717,CVE-2020-25718,CVE-2020-25719,CVE-2020-25721,CVE-2020-25722,CVE-2021-23192,CVE-2021-3738
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    ldb-2.2.2-3.3.1, samba-4.13.13+git.528.140935f8d6a-3.12.1
Comment 7 Swamp Workflow Management 2021-11-10 20:32:36 UTC
SUSE-SU-2021:3647-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1014440,1192214,1192215,1192246,1192247,1192283,1192284,1192505
CVE References: CVE-2016-2124,CVE-2020-25717,CVE-2020-25718,CVE-2020-25719,CVE-2020-25721,CVE-2020-25722,CVE-2021-23192,CVE-2021-3738
JIRA References: 
Sources used:
SUSE MicroOS 5.1 (src):    ldb-2.2.2-3.3.1
SUSE Linux Enterprise Module for Python2 15-SP3 (src):    samba-4.13.13+git.528.140935f8d6a-3.12.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    ldb-2.2.2-3.3.1, samba-4.13.13+git.528.140935f8d6a-3.12.1
SUSE Linux Enterprise High Availability 15-SP3 (src):    samba-4.13.13+git.528.140935f8d6a-3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2022-02-10 17:18:37 UTC
SUSE-SU-2022:0361-1: An update that solves 11 vulnerabilities, contains one feature and has two fixes is now available.

Category: security (critical)
Bug References: 1014440,1188727,1189017,1189875,1192214,1192215,1192246,1192247,1192283,1192284,1192505,1192849,1194859
CVE References: CVE-2016-2124,CVE-2020-17049,CVE-2020-25717,CVE-2020-25718,CVE-2020-25719,CVE-2020-25721,CVE-2020-25722,CVE-2021-20254,CVE-2021-23192,CVE-2021-3738,CVE-2021-44142
JIRA References: SLE-18456
Sources used:
SUSE Enterprise Storage 7 (src):    ldb-2.2.2-4.6.1, samba-4.13.13+git.545.5897c2d94f3-3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.