Skip to content
OpenAdvisories

Description

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.

Affected products

VendorProductAffectedFixed
— samba < 4.17.8 4.17.8
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat OpenShift Container Platform 4 — —
Red Hat Red Hat Storage 3 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 samba 2:4.17.8+dfsg-1 —
Debian 13 samba 2:4.17.8+dfsg-1 —
Debian 12 samba 2:4.17.8+dfsg-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS samba No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS samba No fix yet —
Ubuntu Pro 18.04 LTS samba No fix yet —
Ubuntu Pro 16.04 LTS samba No fix yet —
Ubuntu Pro 14.04 LTS samba No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP5 samba 4.17.9+git.367.dae41ffdd1f-150500.3.5.1 SUSE-SU-2023:2929-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 samba 4.17.9+git.367.dae41ffdd1f-150500.3.5.1 SUSE-SU-2023:2929-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 samba +31 2:4.17.8-0.amzn2023.0.2 ALAS2023-2023-206

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) samba No fix yet —

Advisories 2

References