high
7.5
CWE
264
Advisory Published
CVE Published
Updated

CVE-2020-25720: Samba: check attribute access rights for ldap adds of computers

First published: Tue Aug 20 2024(Updated: )

A delegated administrator who can create objects in Active Directory, can write to all attributes in that new object, including after the object is created because they own the object. This includes some security-sensitive attributes (less in Samba that in Windows). Because these rights are due to there being no ACL at creation time and later being the nebulous 'creator owner', the implication that the delegated administrator retains significant rights may not be well understood. Behaviour removing the implicit rights of creating users to write to all attributes is off by default in Samba and Windows (see CVE-2021-42291 ) (As mentioned in the bug, we developed some other protections for this that landed in the other CVEs, which is why this one didn't get the full security notice treatment). The details of how to turn this protection on are at: <a href="https://support.microsoft.com/en-us/topic/kb5008383-active-directory-permissions-updates-cve-2021-42291-536d5555-ffba-4248-a60e-d6cbc849cde1">https://support.microsoft.com/en-us/topic/kb5008383-active-directory-permissions-updates-cve-2021-42291-536d5555-ffba-4248-a60e-d6cbc849cde1</a>

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Samba

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2020-25720?

    CVE-2020-25720 is considered a medium severity vulnerability that allows delegated administrators in Samba to write to security-sensitive attributes in Active Directory.

  • How do I fix CVE-2020-25720?

    To fix CVE-2020-25720, upgrade to the latest version of Samba where the vulnerability has been patched.

  • What types of systems are affected by CVE-2020-25720?

    CVE-2020-25720 affects systems running Samba that allow delegated users to create and manage Active Directory objects.

  • What are the potential impacts of CVE-2020-25720?

    The potential impacts of CVE-2020-25720 include unauthorized modification of security-sensitive attributes in Active Directory.

  • Who can exploit CVE-2020-25720?

    CVE-2020-25720 can be exploited by delegated administrators who have permission to create objects in Active Directory.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203