Race condition in Samba - CVE-2020-25719

Vulnerability identifier: #VU58095

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25719

CWE-ID: CWE-362

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a race condition. A remote administrator can exploit the race and escalate privileges on the system.

Samba
Gentoo Linux
SUSE MicroOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
CentOS
Red Hat Enterprise Linux for Power, little endian
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise High Availability
openEuler
Ubuntu
Fedora
samba (Debian package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
python3-kdcproxy
python3-jwcrypto
custodia
python3-custodia
ipa-healthcheck
ipa-healthcheck-core
slapi-nis
python3-pyusb
python3-yubico
opendnssec
python3-ldb-debuginfo
python3-ldb-devel
libldb2-32bit
libldb2-32bit-debuginfo
libldb-devel
ldb-tools-debuginfo
ldb-tools
libldb2-debuginfo
libldb2
ldb-debugsource
python3-ldb
libldb
softhsm
softhsm-devel
ipa (Red Hat package)
freeipa
python3-ipatests
ipa-client
ipa-client-epn
ipa-client-samba
ipa-server
ipa-server-trust-ad
ipa-client-common
ipa-python-compat
python3-ipaserver
python3-ipalib
python3-ipaclient
ipa-server-dns
ipa-server-common
ipa-selinux
ipa-common
libwbclient
samba-debuginfo
samba-debugsource
samba-dc-provision
ctdb
samba-krb5-printing
ctdb-tests
samba-client
samba-winbind-krb5-locator
libsmbclient-devel
libwbclient-devel
python3-samba
libsmbclient
samba-winbind
samba
samba-winbind-modules
samba-help
samba-vfs-glusterfs
samba-pidl
samba-common-tools
python3-samba-test
samba-test
samba-common
samba-winbind-clients
samba-libs
samba-dc-bind-dlz
python3-samba-dc
samba-dc
samba-devel
libdcerpc-binding0
ctdb-debuginfo
libndr-krb5pac0
libsamba-credentials0-debuginfo
libsmbclient0
libsamdb0-debuginfo
libsamdb0
libsamba-util0-debuginfo
libsamba-util0
libsamba-passdb0-debuginfo
libsamba-passdb0
libsamba-hostconfig0-debuginfo
libsamba-hostconfig0
libsamba-errors0-debuginfo
libsamba-errors0
samba-winbind-debuginfo
libsamba-credentials0
libnetapi0-debuginfo
libnetapi0
libndr1-debuginfo
libndr1
libndr-standard0-debuginfo
libndr-standard0
libndr-nbt0-debuginfo
libndr-nbt0
libndr-krb5pac0-debuginfo
libdcerpc0-debuginfo
samba-libs-debuginfo
samba-client-debuginfo
samba-ceph-debuginfo
samba-ceph
libdcerpc-binding0-debuginfo
libdcerpc0
libwbclient0-debuginfo
samba-libs-python3
libwbclient0
libtevent-util0-debuginfo
samba-libs-python3-debuginfo
libtevent-util0
libsmbldap2-debuginfo
libsmbldap2
libsmbclient0-debuginfo
libsmbconf0-debuginfo
libsmbconf0
samba (Ubuntu package)
net-fs/samba
python3-qrcode
python3-qrcode-core
bind-dyndb-ldap
QNAP QTS

Install updates from vendor's website.

Samba - addressed in versions 4.13.14, 4.14.10, 4.15.2
samba (Debian package) - update to 2:4.13.13+dfsg-1~deb11u2
QNAP QTS - update to 5.0.0.1891 20211221
python3-kdcproxy - update to 0.4-5
python3-jwcrypto - update to 0.5.0-1
custodia - update to 0.6.0-3
python3-custodia - update to 0.6.0-3
ipa-healthcheck - update to 0.7-6
ipa-healthcheck-core - update to 0.7-6
slapi-nis - update to 0.56.6-4
python3-pyusb - update to 1.0.0-9
python3-yubico - update to 1.3.2-9
opendnssec - update to 2.1.7-1
python3-ldb-debuginfo - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
python3-ldb-devel - update to 2.2.2-3.3.1
libldb2-32bit - update to 2.2.2-3.3.1
libldb2-32bit-debuginfo - update to 2.2.2-3.3.1
libldb-devel - update to 2.2.2-3.3.1
ldb-tools-debuginfo - update to 2.2.2-3.3.1
ldb-tools - update to 2.2.2-3.3.1
libldb2-debuginfo - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
libldb2 - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
ldb-debugsource - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
python3-ldb - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
libldb - addressed in versions 2.2.3-1.fc33, 2.3.2-1.fc34
softhsm - update to 2.6.0-5
softhsm-devel - update to 2.6.0-5
ipa (Red Hat package) - update to 4.6.8-5.el7_9.10
freeipa - addressed in versions 4.9.6-3.fc33, 4.9.6-4.fc34, 4.9.7-4.fc35, 4.9.7-4.fc36
python3-ipatests - update to 4.9.6-10.0.1
ipa-client - update to 4.9.6-10.0.1
ipa-client-epn - update to 4.9.6-10.0.1
ipa-client-samba - update to 4.9.6-10.0.1
ipa-server - update to 4.9.6-10.0.1
ipa-server-trust-ad - update to 4.9.6-10.0.1
ipa-client-common - update to 4.9.6-10.0.1
ipa-python-compat - update to 4.9.6-10.0.1
python3-ipaserver - update to 4.9.6-10.0.1
python3-ipalib - update to 4.9.6-10.0.1
python3-ipaclient - update to 4.9.6-10.0.1
ipa-server-dns - update to 4.9.6-10.0.1
ipa-server-common - update to 4.9.6-10.0.1
ipa-selinux - update to 4.9.6-10.0.1
ipa-common - update to 4.9.6-10.0.1
libwbclient - update to 4.11.12-8
samba-debuginfo - update to 4.11.12-8
samba-debugsource - update to 4.11.12-8
samba-dc-provision - update to 4.11.12-8
ctdb - update to 4.11.12-8
samba-krb5-printing - update to 4.11.12-8
ctdb-tests - update to 4.11.12-8
samba-client - update to 4.11.12-8
samba-winbind-krb5-locator - update to 4.11.12-8
libsmbclient-devel - update to 4.11.12-8
libwbclient-devel - update to 4.11.12-8
python3-samba - update to 4.11.12-8
libsmbclient - update to 4.11.12-8
samba-winbind - update to 4.11.12-8
samba - update to 4.11.12-8
samba-winbind-modules - update to 4.11.12-8
samba-help - update to 4.11.12-8
samba-vfs-glusterfs - update to 4.11.12-8
samba-pidl - update to 4.11.12-8
samba-common-tools - update to 4.11.12-8
python3-samba-test - update to 4.11.12-8
samba-test - update to 4.11.12-8
samba-common - update to 4.11.12-8
samba-winbind-clients - update to 4.11.12-8
samba-libs - update to 4.11.12-8
samba-dc-bind-dlz - update to 4.11.12-8
python3-samba-dc - update to 4.11.12-8
samba-dc - update to 4.11.12-8
samba-devel - update to 4.11.12-8
libdcerpc-binding0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
ctdb-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
ctdb - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-krb5pac0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-credentials0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbclient0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamdb0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamdb0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-util0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-util0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-passdb0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-passdb0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-hostconfig0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-hostconfig0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-errors0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-errors0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-winbind-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-credentials0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libnetapi0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libnetapi0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr1-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr1 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-standard0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-standard0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-nbt0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-nbt0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-krb5pac0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libdcerpc0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-client - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-client-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-debugsource - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-ceph-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-ceph - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libdcerpc-binding0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libdcerpc0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libwbclient0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs-python3 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libwbclient0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libtevent-util0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs-python3-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libtevent-util0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbldap2-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-winbind - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbldap2 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbclient0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbconf0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbconf0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba (Ubuntu package) - addressed in versions 2:4.13.14+dfsg-0ubuntu0.20.04.1, 2:4.13.14+dfsg-0ubuntu0.20.04.3, 2:4.13.14+dfsg-0ubuntu0.20.04.4, 2:4.13.14+dfsg-0ubuntu0.21.04.1, 2:4.13.14+dfsg-0ubuntu0.21.04.3, 2:4.13.14+dfsg-0ubuntu0.21.04.4, 2:4.13.14+dfsg-0ubuntu0.21.10.1, 2:4.13.14+dfsg-0ubuntu0.21.10.3, 2:4.13.14+dfsg-0ubuntu0.21.10.4
samba - addressed in versions 4.13.14-2.fc33, 4.14.10-2.fc34, 4.15.2-2.fc36, 4.15.2-3.fc35
net-fs/samba - update to 4.18.4
python3-qrcode - update to 5.1-12
python3-qrcode-core - update to 5.1-12
bind-dyndb-ldap - update to 11.6-2

• https://www.samba.org/samba/security/CVE-2020-25719.html

• Multiple vulnerabilities in Samba
• Debian update for samba
• Red Hat Enterprise Linux 7 update for ipa
• Red Hat Enterprise Linux 8 update for the idm:DL1 module
• CentOS 7 update for ipa
• Red Hat Enterprise Linux 8.4 update for the idm:DL1 module
• Red Hat Enterprise Linux 8.2 update for the idm:DL1 module
• Multiple vulnerabilities in QNAP QTS
• SUSE update for samba and ldb
• Ubuntu update for samba
• Ubuntu update for samba
• Ubuntu update for samba
• SUSE update for ldb, samba
• Gentoo update for Samba
• openEuler update for samba
• Fedora 36 update for freeipa, samba
• Fedora 35 update for freeipa, samba
• Fedora 34 update for freeipa, libldb, samba
• Fedora 33 update for freeipa, libldb, samba
• Anolis OS update for idm:DL1 module