Bugzilla – Bug 1192246
VUL-0: CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers
Last modified: 2022-02-10 17:18:37 UTC
CRD: 2021-11-09
i spublic CVE-2020-25718.html: =========================================================== == Subject: Samba AD DC did not correctly sandbox == Kerberos tickets issued by an RODC. == == CVE ID#: CVE-2020-25718 == == Versions: Samba 4.0.0 and later == == Summary: The Samba AD DC, when joined by an RODC, did == not confirm if the RODC was allowed to print a == ticket for that user. =========================================================== =========== Description =========== Samba as an Active Directory Domain Controller is able to support an RODC, which is meant to have minimal privileges in a domain. However, in accepting a ticket from a Samba or Windows RODC, Samba was not confirming that the RODC is authorized to print such a ticket, via the msDS-NeverRevealGroup and msDS-RevealOnDemandGroup (typically "Allowed RODC Replication Group" and "Denied RODC Replciation Group"). This would allow an RODC to print administrator tickets. ================== Patch Availability ================== Patches addressing both these issues have been posted to: https://www.samba.org/samba/security/ Additionally, Samba 4.15.2, 4.14.10 and 4.13.14 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5) ========== Workaround ========== ======= Credits ======= Originally reported by Andrew Bartlett. Patches provided by: - Andrew Bartlett of Catalyst and the Samba Team. - Douglas Bagnall of Catalyst and the Samba Team. - Joseph Sutton of Catalyst and the Samba Team Catalyst wishes to thank Univention Gmbh in particular for their support towards the production of this fix. Advisory written by Andrew Bartlett of Catalyst ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ==========================================================
openSUSE-SU-2021:3647-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1014440,1192214,1192215,1192246,1192247,1192283,1192284,1192505 CVE References: CVE-2016-2124,CVE-2020-25717,CVE-2020-25718,CVE-2020-25719,CVE-2020-25721,CVE-2020-25722,CVE-2021-23192,CVE-2021-3738 JIRA References: Sources used: openSUSE Leap 15.3 (src): ldb-2.2.2-3.3.1, samba-4.13.13+git.528.140935f8d6a-3.12.1
SUSE-SU-2021:3647-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1014440,1192214,1192215,1192246,1192247,1192283,1192284,1192505 CVE References: CVE-2016-2124,CVE-2020-25717,CVE-2020-25718,CVE-2020-25719,CVE-2020-25721,CVE-2020-25722,CVE-2021-23192,CVE-2021-3738 JIRA References: Sources used: SUSE MicroOS 5.1 (src): ldb-2.2.2-3.3.1 SUSE Linux Enterprise Module for Python2 15-SP3 (src): samba-4.13.13+git.528.140935f8d6a-3.12.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): ldb-2.2.2-3.3.1, samba-4.13.13+git.528.140935f8d6a-3.12.1 SUSE Linux Enterprise High Availability 15-SP3 (src): samba-4.13.13+git.528.140935f8d6a-3.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0361-1: An update that solves 11 vulnerabilities, contains one feature and has two fixes is now available. Category: security (critical) Bug References: 1014440,1188727,1189017,1189875,1192214,1192215,1192246,1192247,1192283,1192284,1192505,1192849,1194859 CVE References: CVE-2016-2124,CVE-2020-17049,CVE-2020-25717,CVE-2020-25718,CVE-2020-25719,CVE-2020-25721,CVE-2020-25722,CVE-2021-20254,CVE-2021-23192,CVE-2021-3738,CVE-2021-44142 JIRA References: SLE-18456 Sources used: SUSE Enterprise Storage 7 (src): ldb-2.2.2-4.6.1, samba-4.13.13+git.545.5897c2d94f3-3.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.