Permissions, Privileges, and Access Controls in Samba - CVE-2020-25718

Vulnerability identifier: #VU58096

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25718

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to escalate privileges on the system.

The vulnerability exists due to Samba AD DC does not correctly sandbox Kerberos tickets issued by an RODC, which leads to security restrictions bypass and privilege escalation.

Samba
Gentoo Linux
SUSE MicroOS
SUSE Enterprise Storage
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Module for Python2
openEuler
Ubuntu
Fedora
samba (Debian package)
ldb-debugsource
libldb2
libldb2-debuginfo
ldb-tools
ldb-tools-debuginfo
libldb-devel
python3-ldb
python3-ldb-debuginfo
python3-ldb-devel
libldb2-32bit
libldb2-32bit-debuginfo
libldb
freeipa
samba-test
samba
samba-winbind-modules
libwbclient
samba-winbind
libsmbclient
python3-samba
libwbclient-devel
libsmbclient-devel
samba-winbind-krb5-locator
samba-client
ctdb-tests
samba-krb5-printing
ctdb
samba-debuginfo
python3-samba-test
samba-debugsource
samba-common
samba-winbind-clients
samba-common-tools
samba-libs
samba-dc-bind-dlz
python3-samba-dc
samba-dc
samba-pidl
samba-vfs-glusterfs
samba-help
samba-devel
samba-dc-provision
libsmbconf0-debuginfo
samba-ceph
samba-ceph-debuginfo
samba-client-debuginfo
samba-libs-debuginfo
samba-libs-python3
samba-libs-python3-debuginfo
samba-winbind-debuginfo
libndr-nbt0
libsamba-credentials0-debuginfo
libsamba-credentials0
libnetapi0-debuginfo
libnetapi0
libndr1-debuginfo
libndr1
libndr-standard0-debuginfo
libndr-standard0
libndr-nbt0-debuginfo
libwbclient0
libndr-krb5pac0-debuginfo
libndr-krb5pac0
libdcerpc0-debuginfo
libdcerpc0
libdcerpc-binding0-debuginfo
libdcerpc-binding0
ctdb-debuginfo
libsamba-errors0-debuginfo
libwbclient0-debuginfo
libtevent-util0-debuginfo
libtevent-util0
libsmbldap2-debuginfo
libsmbldap2
libsmbconf0
libsmbclient0-debuginfo
libsmbclient0
libsamdb0
libsamba-util0-debuginfo
libsamba-util0
libsamdb0-debuginfo
libsamba-passdb0-debuginfo
libsamba-passdb0
libsamba-hostconfig0-debuginfo
libsamba-hostconfig0
libsamba-errors0
samba (Ubuntu package)
net-fs/samba
QNAP QTS

Install updates from vendor's website.

Samba - addressed in versions 4.13.14, 4.14.10, 4.15.2
samba (Debian package) - update to 2:4.13.13+dfsg-1~deb11u2
QNAP QTS - update to 5.0.0.1891 20211221
ldb-debugsource - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
libldb2 - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
libldb2-debuginfo - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
ldb-tools - update to 2.2.2-3.3.1
ldb-tools-debuginfo - update to 2.2.2-3.3.1
libldb-devel - update to 2.2.2-3.3.1
python3-ldb - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
python3-ldb-debuginfo - addressed in versions 2.2.2-3.3.1, 2.2.2-4.6.1
python3-ldb-devel - update to 2.2.2-3.3.1
libldb2-32bit - update to 2.2.2-3.3.1
libldb2-32bit-debuginfo - update to 2.2.2-3.3.1
libldb - addressed in versions 2.2.3-1.fc33, 2.3.2-1.fc34
freeipa - addressed in versions 4.9.6-3.fc33, 4.9.6-4.fc34, 4.9.7-4.fc35, 4.9.7-4.fc36
samba-test - update to 4.11.12-8
samba - update to 4.11.12-8
samba-winbind-modules - update to 4.11.12-8
libwbclient - update to 4.11.12-8
samba-winbind - update to 4.11.12-8
libsmbclient - update to 4.11.12-8
python3-samba - update to 4.11.12-8
libwbclient-devel - update to 4.11.12-8
libsmbclient-devel - update to 4.11.12-8
samba-winbind-krb5-locator - update to 4.11.12-8
samba-client - update to 4.11.12-8
ctdb-tests - update to 4.11.12-8
samba-krb5-printing - update to 4.11.12-8
ctdb - update to 4.11.12-8
samba-debuginfo - update to 4.11.12-8
python3-samba-test - update to 4.11.12-8
samba-debugsource - update to 4.11.12-8
samba-common - update to 4.11.12-8
samba-winbind-clients - update to 4.11.12-8
samba-common-tools - update to 4.11.12-8
samba-libs - update to 4.11.12-8
samba-dc-bind-dlz - update to 4.11.12-8
python3-samba-dc - update to 4.11.12-8
samba-dc - update to 4.11.12-8
samba-pidl - update to 4.11.12-8
samba-vfs-glusterfs - update to 4.11.12-8
samba-help - update to 4.11.12-8
samba-devel - update to 4.11.12-8
samba-dc-provision - update to 4.11.12-8
libsmbconf0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-ceph - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-ceph-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-client - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-client-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-debugsource - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs-python3 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-libs-python3-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-winbind - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba-winbind-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-nbt0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-credentials0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-credentials0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libnetapi0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libnetapi0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr1-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr1 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-standard0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-standard0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-nbt0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libwbclient0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-krb5pac0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libndr-krb5pac0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libdcerpc0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libdcerpc0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libdcerpc-binding0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libdcerpc-binding0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
ctdb-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
ctdb - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-errors0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libwbclient0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libtevent-util0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libtevent-util0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbldap2-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbldap2 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbconf0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbclient0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsmbclient0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamdb0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-util0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-util0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamdb0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-passdb0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-passdb0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-hostconfig0-debuginfo - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-hostconfig0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
libsamba-errors0 - update to 4.13.13+git.545.5897c2d94f3-3.12.1
samba (Ubuntu package) - addressed in versions 2:4.13.14+dfsg-0ubuntu0.20.04.1, 2:4.13.14+dfsg-0ubuntu0.20.04.3, 2:4.13.14+dfsg-0ubuntu0.20.04.4, 2:4.13.14+dfsg-0ubuntu0.21.04.1, 2:4.13.14+dfsg-0ubuntu0.21.04.3, 2:4.13.14+dfsg-0ubuntu0.21.04.4, 2:4.13.14+dfsg-0ubuntu0.21.10.1, 2:4.13.14+dfsg-0ubuntu0.21.10.3, 2:4.13.14+dfsg-0ubuntu0.21.10.4
samba - addressed in versions 4.13.14-2.fc33, 4.14.10-2.fc34, 4.15.2-2.fc36, 4.15.2-3.fc35
net-fs/samba - update to 4.18.4

• https://www.samba.org/samba/security/CVE-2020-25718.html

• Multiple vulnerabilities in Samba
• Debian update for samba
• Multiple vulnerabilities in QNAP QTS
• SUSE update for samba and ldb
• Ubuntu update for samba
• Ubuntu update for samba
• Ubuntu update for samba
• SUSE update for ldb, samba
• Gentoo update for Samba
• openEuler update for samba
• Fedora 36 update for freeipa, samba
• Fedora 35 update for freeipa, samba
• Fedora 34 update for freeipa, libldb, samba
• Fedora 33 update for freeipa, libldb, samba