CVE-2020-25718

samba: Samba AD DC did not correctly sandbox Kerberos tickets issues by an RODC

A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Fedoraproject Samba

Products

Fedora Samba

CVE-2020-25717

samba: Active Directory (AD) domain user could become root on domain members

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 25 more

CVE-2020-17049

Kerberos KDC Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

CVSS 3.1 · 6.6 Medium EPSS 13.8% KEV · Not listed

Vendors

Microsoft Redhat Samba

Products

Windows Server 1903 Windows Server 1909 Windows Server 2004 and 10 more

CVE-2020-14383

samba: An authenticated user can crash the DCE/RPC DNS with easily crafted records

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Samba

CVE-2020-14323

samba: Unprivileged user can crash winbind

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 2 more

Products

Debian Linux Fedora Leap and 3 more

CVE-2020-14318

samba: Missing handle permissions check in SMB1/2/3 ChangeNotify

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Storage Samba

CVE-2020-14303

samba: Empty UDP packet DoS in Samba AD DC nbtd

A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 2 more

CVE-2020-10760

samba: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV

A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed

Vendors

Canonical Fedoraproject Opensuse and 1 more

Products

Ubuntu Linux Fedora Leap and 1 more

CVE-2020-10745

samba: Parsing and packing of NBT and DNS packets can consume excessive CPU

A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 1 more

Products

Debian Linux Fedora Leap and 1 more

CVE-2020-10730

samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results

A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 2 more

Products

Debian Linux Fedora Leap and 3 more

CVE-2020-10704

samba: LDAP Denial of Service (stack overflow) in Samba AD DC

A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 1 more

Products

Debian Linux Fedora Leap and 1 more

CVE-2020-10700

samba: Use-after-free in Samba AD DC LDAP Server with ASQ

A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.

CVSS 3.1 · 5.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Fedoraproject Opensuse Samba

Products

Fedora Leap Samba

CVE-2019-3880

samba: save registry file outside share as unprivileged user

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.

CVSS 3.1 · 5.4 Medium EPSS 3.2% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 2 more

Products

Debian Linux Fedora Leap and 4 more

CVE-2019-3824

samba: Out of bound read in ldb_wildcard_compare in Samba AD DC

A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service.

CVSS 3.0 · 6.5 Medium EPSS 2.8% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba

CVE-2019-14902

samba: Replication of ACLs set to inherit down a subtree on AD Directory not automatic

There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.

CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Not listed

Vendors

Canonical Debian Opensuse and 1 more

Products

Ubuntu Linux Debian Linux Leap and 1 more

CVE-2019-14870

samba: The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

CVSS 3.1 · 5.4 Medium EPSS 2.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 2 more

CVE-2019-14861

samba: An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.

CVSS 3.1 · 5.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 2 more

CVE-2019-14847

samba: samba AD DC LDAP denial of service via dirsync

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue.

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed

Vendors

Fedoraproject Opensuse Samba

Products

Fedora Leap Samba

CVE-2019-14833

samba: AD DC check password script does not receive full password when non-ASCII characters are used

A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.

CVSS 3.1 · 5.4 Medium EPSS 1.9% KEV · Not listed

Vendors

Fedoraproject Opensuse Samba

Products

Fedora Leap Samba

CVE-2019-12436

samba: NULL pointer dereference in Samba LDAP server leading to crash and Dos

Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit.

CVSS 3.0 · 6.5 Medium EPSS 2.8% KEV · Not listed

Vendors

Canonical Samba

Products

Ubuntu Linux Samba