CVE-2020-25717: Input Validation
A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
Other sources
As per upstream advisory:
Windows Active Directory domains have, but default, a feature to allow users to create computer accounts, controlled by ms-DS-MachineAccountQuota.
Likewise, some (presumably trusted) users have the right to create new users or computers in Active Directory Domains, both Samba and Windows based.
When Samba, as an AD Domain member accepts a Kerberos ticket, it must map the information found therein to a local user. This is done via the name in the Kerberos PAC, or the name in the ticket (if there is no PAC).
Samba will attempt to find a user "DOMAIN\user" before falling back to just "user".
If the DOMAIN\user lookup can be made to fail, then a privilege escallation is possible.
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25717?
CVE-2020-25717 is classified as a medium severity vulnerability as it allows for potential privilege escalation for authenticated attackers.
How do I fix CVE-2020-25717?
To remediate CVE-2020-25717, you should update Samba to a patched version as specified in your vendor's advisory.
What systems are affected by CVE-2020-25717?
CVE-2020-25717 affects various versions of Samba on Red Hat and Debian systems, including specific versions noted in the vulnerability advisory.
Is CVE-2020-25717 exploitable remotely?
No, CVE-2020-25717 requires authenticated access to exploit, meaning an attacker must already have valid credentials.
What versions of Samba should I upgrade to mitigate CVE-2020-25717?
To mitigate CVE-2020-25717, upgrade Samba to versions 4.10.16-17.el7_9, 4.14.5-7.el8_5, or later secure versions as indicated by your distribution.