Permissions, Privileges, and Access Controls in Samba - CVE-2020-25720

Vulnerability identifier: #VU86856

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25720

CWE-ID: CWE-264

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges within the network.

The vulnerability exists due to create child permissions allows full write access to all attributes. A local user can escalate privileges within the network.

Samba
Amazon Linux AMI
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
openSUSE Leap
samba
samba-doc
samba-client-libs-32bit-debuginfo
samba-client-32bit-debuginfo
libsamba-policy0-python3-32bit-debuginfo
samba-libs-python3-32bit-debuginfo
libsamba-policy0-python3-32bit
samba-devel-32bit
samba-libs-python3-32bit
samba-winbind-libs-32bit-debuginfo
samba-libs-32bit-debuginfo
samba-client-32bit
samba-winbind-libs-32bit
samba-libs-32bit
samba-client-libs-32bit
samba-tool
samba-ceph-debuginfo
samba-ceph
samba-libs-python3-64bit-debuginfo
samba-winbind-libs-64bit
samba-libs-python3-64bit
samba-client-libs-64bit-debuginfo
samba-client-64bit-debuginfo
samba-devel-64bit
samba-libs-64bit-debuginfo
libsamba-policy0-python3-64bit-debuginfo
samba-client-libs-64bit
libsamba-policy0-python3-64bit
samba-winbind-libs-64bit-debuginfo
samba-client-64bit
samba-libs-64bit
samba-client
libsamba-policy-python3-devel
samba-libs-debuginfo
samba-python3-debuginfo
ctdb-pcp-pmda-debuginfo
samba-client-libs-debuginfo
samba-devel
samba-python3
libsamba-policy0-python3-debuginfo
samba-test
samba-libs-python3-debuginfo
samba-winbind-debuginfo
samba-debuginfo
samba-client-debuginfo
samba-ldb-ldap
samba-ldb-ldap-debuginfo
samba-debugsource
libsamba-policy0-python3
ctdb-pcp-pmda
samba-test-debuginfo
samba-libs
samba-winbind-libs
samba-gpupdate
samba-winbind-libs-debuginfo
samba-client-libs
samba-winbind
samba-libs-python3
ctdb
ctdb-debuginfo
libsamba-policy-devel

Install updates from vendor's website.

Samba - update to 4.17.9
samba - update to 4.17.8-0
samba-doc - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-libs-32bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-32bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy0-python3-32bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-python3-32bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy0-python3-32bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-devel-32bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-python3-32bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind-libs-32bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-32bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-32bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind-libs-32bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-32bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-libs-32bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-tool - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-ceph-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-ceph - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-python3-64bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind-libs-64bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-python3-64bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-libs-64bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-64bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-devel-64bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-64bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy0-python3-64bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-libs-64bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy0-python3-64bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind-libs-64bit-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-64bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-64bit - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy-python3-devel - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-python3-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
ctdb-pcp-pmda-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-libs-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-devel - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-python3 - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy0-python3-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-test - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-python3-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-ldb-ldap - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-ldb-ldap-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-debugsource - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy0-python3 - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
ctdb-pcp-pmda - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-test-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind-libs - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-gpupdate - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind-libs-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-client-libs - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-winbind - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
samba-libs-python3 - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
ctdb - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
ctdb-debuginfo - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1
libsamba-policy-devel - update to 4.17.9+git.367.dae41ffdd1f-150500.3.5.1

• https://bugzilla.samba.org/show_bug.cgi?id=14810
• https://gitlab.com/samba-team/samba/-/commit/cc64ea24daa649dc8de4a212c7abfbe111095655
• https://gitlab.com/samba-team/samba/-/merge_requests/2514

• Privilege escalation in Samba
• SUSE update for samba
• Amazon Linux AMI update for samba
• Amazon Linux AMI update for samba