Summary
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos
tickets issues by an RODC. An RODC could print administrator tickets,
contrary to expectations. (CVE-2020-25718)
Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets.
Delegated administrators could possibly use this issue to impersonate
accounts, leading to total domain compromise. (CVE-2020-25719)
Andrew Bartlett discovered that Samba did not provide stable AD
identifiers to Kerberos acceptors. (CVE-2020-25721)
Andrew Bartlett discovered that Samba did not properly check sensitive
attributes. An authenticated attacker could possibly use this issue to
escalate privileges. (CVE-2020-25722)
Stefan Metzmacher discovered that Samba incorrectly handled certain large
DCE/RPC requests. A remote attacker could possibly use this issue to
bypass signature requirements. (CVE-2021-23192)
William Ross discovered that Samba incorrectly handled memory. A remote
attacker could use this issue to cause Samba to crash, resulting in a
denial of service, or possibly escalate privileges. (CVE-2021-3738)
Joseph Sutton discovered that Samba incorrectly handled certain TGS
requests. An authenticated attacker could possibly use this issue to cause
Samba to crash, resulting in a denial of service. (CVE-2021-3671)
The fix for CVE-2020-25717 results in possible behaviour changes that could
affect certain environments. Please see the upstream advisory for more
information:
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | samba | 2:4.13.14+dfsg-0ubuntu0.20.04.1 |
Vulnerabilities 9
-
Unscored —
A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plai…
-
Unscored —
A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to ca…
-
Unscored —
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only doma…
-
Unscored —
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentica…
-
Unscored —
Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for L…
-
Unscored —
Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacke…
-
Unscored —
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request,…
-
Unscored —
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Grantin…
-
Unscored —
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanis…
References
-
report
https://ubuntu.com/security/CVE-2016-2124
-
report
https://ubuntu.com/security/CVE-2020-25717
-
report
https://ubuntu.com/security/CVE-2020-25718
-
report
https://ubuntu.com/security/CVE-2020-25719
-
report
https://ubuntu.com/security/CVE-2020-25721
-
report
https://ubuntu.com/security/CVE-2020-25722
-
report
https://ubuntu.com/security/CVE-2021-3671
-
report
https://ubuntu.com/security/CVE-2021-3738
-
report
https://ubuntu.com/security/CVE-2021-23192