Corrections have been released for Samba versions 4.15.2, 4.14.10, and 4.13.14, addressing 8 vulnerabilities, most of which could lead to complete compromise of the Active Directory domain. Notably, one of the issues has been fixed since 2016, and five since 2020; nevertheless, one fix resulted in the inability to start winbindd when the 'allow trusted domains = no' setting was in place (the developers intend to promptly release another update with a fix). The release of package updates in distributions can be tracked on the following pages: Debian, Ubuntu, RHEL, SUSE, Fedora, Arch, FreeBSD.
Resolved vulnerabilities:
- CVE-2020-25717 — due to shortcomings in the logic for mapping domain users to local system users, an Active Directory domain user with the capability to create new accounts on their system, managed through ms-DS-MachineAccountQuota, could gain root access to other systems within the domain. domain.
- CVE-2021-3738 — a use-after-free vulnerability in the implementation of the RPC server Samba AD DC (dsdb), which could potentially lead to privilege escalation when manipulating connection setups.
- CVE-2016-2124 — client connections established using the SMB1 protocol could lead to the transmission of authentication parameters in plain text or via NTLM (for example, to capture credentials during MITM attacks), even if mandatory Kerberos authentication is defined in the settings for the user or application.
- CVE-2020-25722 — the Active Directory domain controller based on Samba did not perform proper access checks on stored data, allowing any user to bypass authorization checks and fully compromise the domain.
- CVE-2020-25718 — the Active Directory domain controller based on Samba did not correctly isolate Kerberos tickets issued by RODC (Read-only domain controller), which could be exploited to obtain administrator tickets from RODC without proper authorization.
- CVE-2020-25719 — the Active Directory domain controller based on Samba did not consistently account for the SID and PAC fields in Kerberos tickets (where the setting 'gensec:require_pac = true' only checked the name and did not consider PAC), allowing a user with the right to create accounts on the local system to impersonate another user in the domain, including a privileged one.
- CVE-2020-25721 — For users authenticated using Kerberos, non-unique identifiers for Active Directory (objectSid) were sometimes issued, which could lead to one user intersecting with another.
- CVE-2021-23192 — During a MITM attack, it was possible to replace fragments in large DCE/RPC requests that were split into several parts.
Source: opennet.ru
