Overview
- Description
- A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
- Source
- secalert@redhat.com
- NVD status
- Modified
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1CC08E7-E96D-4475-ACB6-22CDF280913E",
"versionEndExcluding": "4.17.12",
"versionStartIncluding": "4.0.0"
},
{
"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A33312F-1523-4647-83DA-6DD6231906F9",
"versionEndExcluding": "4.18.8",
"versionStartIncluding": "4.18.0"
},
{
"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE496104-DDB5-4709-8026-C83E99B0C865",
"versionEndExcluding": "4.19.1",
"versionStartIncluding": "4.19.0"
}
],
"operator": "OR"
}
]
}
]