CVE-2020-25718: High severity samba vulnerability
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
Other sources
As per upstream advisory:
Samba as an Active Directory Domain Controller is able to support an RODC, which is meant to have minimal privileges in a domain.
However, in accepting a ticket from a Samba or Windows RODC, Samba was not confirming that the RODC is authorized to print such a ticket, via the msDS-NeverRevealGroup and msDS-RevealOnDemandGroup (typically "Allowed RODC Replication Group" and "Denied RODC Replciation Group").
This would allow an RODC to print administrator tickets.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-25718?
CVE-2020-25718 is a vulnerability found in Samba, which allows an RODC (read-only domain controller) to print administrator tickets.
What is the severity of CVE-2020-25718?
The severity of CVE-2020-25718 is high with a CVSS score of 8.8.
Which software is affected by CVE-2020-25718?
Samba versions 4.0.0 to 4.13.14 and 4.14.0 to 4.14.10, as well as Fedora 35, are affected by CVE-2020-25718.
How do I fix CVE-2020-25718?
To fix CVE-2020-25718, update your Samba software to version 4.13.14, 4.14.10, or 4.15.2.
Where can I find more information about CVE-2020-25718?
You can find more information about CVE-2020-25718 on the Red Hat Bugzilla, Gentoo GLSA, and Samba websites.