CVE-2020-25721: Input Validation
First published: Wed Nov 10 2021(Updated: )
As per upstream report: In order to avoid issues like <a href="https://access.redhat.com/security/cve/CVE-2020-25717">CVE-2020-25717</a> AD Kerberos accepting services need access to unique, and ideally long-term stable identifiers of a user to perform authorization. The AD PAC provides this, but the most useful information is kept in a buffer which is NDR encoded, which means that so far in Free Software only Samba and applications which use Samba components under the hood like FreeIPA and SSSD decode PAC. Recognising that the issues seen in Samba are not unique, Samba now provides an extension to UPN_DNS_INFO, a component of the AD PAC, in a way that can be parsed using basic pointer handling. From this, future non-Samba based Kerberised applications can easily obtain the user's SID, in the same packing as objectSID in LDAP, confident that the ticket represents a specific user, not matter subsequent renames. This will allow such non-Samba applications to avoid confusing one Kerberos user for another, even if they have the same string name (due to the gap between time of ticket printing by the KDC and time of ticket acceptance).
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/samba | <4.15.2 | 4.15.2 |
| redhat/samba | <4.14.10 | 4.14.10 |
| redhat/samba | <4.13.14 | 4.13.14 |
| debian/samba | 2:4.13.13+dfsg-1~deb11u6 2:4.17.12+dfsg-0+deb12u1 2:4.21.1+dfsg-2 | |
| Samba | >=4.13.0<4.13.14 | |
| Samba | >=4.14.0<4.14.10 | |
| Samba | >=4.15.0<4.15.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2021728
- https://bugzilla.samba.org/show_bug.cgi?id=14725
- https://security.gentoo.org/glsa/202309-06
- https://www.samba.org/samba/security/CVE-2020-25721.html
- https://launchpad.net/bugs/cve/CVE-2020-25721
- https://access.redhat.com/security/cve/CVE-2020-25717
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2021729
- https://bugzilla.samba.org/show_bug.cgi?id=14557
- https://security-tracker.debian.org/tracker/CVE-2020-25721
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25721
- https://nvd.nist.gov/vuln/detail/CVE-2020-25721
- https://ubuntu.com/security/CVE-2020-25721
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-25721.
What is the severity of CVE-2020-25721?
The severity of CVE-2020-25721 is high with a CVSS score of 8.8.
What software versions are affected by CVE-2020-25721?
Samba versions 4.13.0 to 4.13.14, 4.14.0 to 4.14.10, and 4.15.0 to 4.15.2 are affected.
How can Linux applications obtain a reliable SID and samAccountName in issued tickets with Samba?
Samba as an Active Directory Domain Controller provides a way for Linux applications to obtain a reliable SID and samAccountName in issued tickets.
Where can I find more information about CVE-2020-25721?
You can find more information about CVE-2020-25721 in the following references: [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=2021728), [Bugzilla Samba](https://bugzilla.samba.org/show_bug.cgi?id=14725), [Gentoo Security](https://security.gentoo.org/glsa/202309-06).
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/severity
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-25721
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- package-manager/redhat
- package-manager/debian
- vendor/samba
- canonical/samba
- version/samba/4.13.0
- version/samba/4.14.0
- version/samba/4.15.0