CVE-2020-25722: High severity samba vulnerability
As per upstream advisory:
Samba as an Active Directory Domain Controller has to take care to protect a number of sensitive attributes, and to follow a security model from Active Directory that relies totally on the intersection of NT security descriptors and the underlying X.500 Directory Access Protocol (as then expressed in LDAP) schema constraints for security.
Some attributes in Samba AD are sensitive, they apply to one object but protect others.
Users who can set msDS-AllowedToDelegateTo can become any user in the domain on the server pointed at by this list. Likewise in a domain mixed with Microsoft Windows, Samba's lack of protection of sidHistory would be a similar issue.
This would be limited to users with the right to create users or modify them (typically those who created them), however, due to other flaws, all users are able to create new user objects.
Other sources
Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25722?
CVE-2020-25722 is a vulnerability found in Samba AD DC that allows an attacker to cause total domain compromise.
What is the severity of CVE-2020-25722?
The severity of CVE-2020-25722 is high with a score of 8.8.
Which software versions are affected by CVE-2020-25722?
Samba versions from 4.0.0 to 4.13.14, as well as versions 4.14.0 to 4.14.10 and 4.15.0 to 4.15.2 are affected by CVE-2020-25722.
How can I fix CVE-2020-25722?
To fix CVE-2020-25722, update Samba to version 4.15.2, 4.14.10, or 4.13.14, depending on your distribution.
Where can I find more information about CVE-2020-25722?
You can find more information about CVE-2020-25722 on Bugzilla, Security Gentoo, and the official Samba website.