Samba's implementation of a domain controller is affected by the ZeroLogin vulnerability

Samba project developers warned users that recently identified on Windows, the ZeroLogin vulnerability (CVE-2020-1472) is manifested and in a Samba-based domain controller implementation. Vulnerability caused flaws in the MS-NRPC protocol and the AES-CFB8 crypto algorithm, and if successfully exploited, allows an attacker to gain administrator access to a domain controller.

The essence of the vulnerability is that the MS-NRPC (Netlogon Remote Protocol) protocol allows, when exchanging authentication data, to fall back to using an RPC connection without encryption. An attacker can then use a flaw in the AES-CFB8 algorithm to fake (spoof) a successful login. It takes an average of 256 spoofing attempts to log in as an administrator. The attack does not require a work account on the domain controller - spoofing attempts can be made using an incorrect password. The NTLM authentication request will be redirected to the domain controller, which will return an access denied, but an attacker can spoof this response, and the attacked system will consider the login successful.

In Samba, the vulnerability appears only on systems that do not use the "server schannel = yes" setting, which is the default since Samba 4.8. In particular, systems with “server schannel = no” and “server schannel = auto” settings can be compromised, which allow Samba to use the same flaws in the AES-CFB8 algorithm as in Windows.

When using a Windows-prepared reference exploit prototype, only the ServerAuthenticate3 call works in Samba, and the ServerPasswordSet2 operation fails (the exploit needs to be adapted for Samba). About the performance of alternative exploits (1, 2, 3, 4) is not reported. Attack attempts on systems can be tracked by analyzing the presence of entries mentioning ServerAuthenticate3 and ServerPasswordSet in the Samba audit logs.

Source: opennet.ru