CVE-2020-25717: Input Validation
A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
Other sources
As per upstream advisory:
Windows Active Directory domains have, but default, a feature to allow users to create computer accounts, controlled by ms-DS-MachineAccountQuota.
Likewise, some (presumably trusted) users have the right to create new users or computers in Active Directory Domains, both Samba and Windows based.
When Samba, as an AD Domain member accepts a Kerberos ticket, it must map the information found therein to a local user. This is done via the name in the Kerberos PAC, or the name in the ticket (if there is no PAC).
Samba will attempt to find a user "DOMAIN\user" before falling back to just "user".
If the DOMAIN\user lookup can be made to fail, then a privilege escallation is possible.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.10.16-17.el7_9 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.14.5-7.el8_5 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.11.2-18.el8_2 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.11.6-114.el7 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.14.5-204.el8 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.3.21-20220126.0.el7_9 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.15.2 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.14.10 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.13.14 - Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.13.13+dfsg-1~deb11u6Fixed in 2:4.17.12+dfsg-0+deb12u1Fixed in 2:4.21.1+dfsg-2 - Configuration
Set gensec:require_pac=true in smb.conf; this relies on nss_winbind being in use, winbind use default domain = no, and no error paths being hit.
Samba gensec:require_pac = true - Compensating control
Pre-create disabled users in Active Directory matching all privileged local usernames that are not held in Active Directory, including names such as root or other privileged names used by AD-connected services, so DOMAIN\user lookups do not fall back to the local username.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25717?
CVE-2020-25717 is classified as a medium severity vulnerability as it allows for potential privilege escalation for authenticated attackers.
How do I fix CVE-2020-25717?
To remediate CVE-2020-25717, you should update Samba to a patched version as specified in your vendor's advisory.
What systems are affected by CVE-2020-25717?
CVE-2020-25717 affects various versions of Samba on Red Hat and Debian systems, including specific versions noted in the vulnerability advisory.
Is CVE-2020-25717 exploitable remotely?
No, CVE-2020-25717 requires authenticated access to exploit, meaning an attacker must already have valid credentials.
What versions of Samba should I upgrade to mitigate CVE-2020-25717?
To mitigate CVE-2020-25717, upgrade Samba to versions 4.10.16-17.el7_9, 4.14.5-7.el8_5, or later secure versions as indicated by your distribution.