Vulnerability-Lookup

OESA-2021-1461 (CVE-2016-2124)

Vulnerability from osv_openeuler – Published: 2021-12-10 11:04 – Updated: 2026-08-06 11:04 – Source website

Summary

samba security update

Details

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was discovered in the way samba implements SMB1 authentication. Even if Kerberos authentication is required, an attacker can use this flaw to retrieve the clear text password sent over the wire.(CVE-2016-2124)

Several flaws were found in the way that samba AD DC implements storage data access and consistency checking. Attackers can use this flaw to cause damage to the entire domain.(CVE-2020-25722)

A use-after-free issue was found in the Samba AD DC RPC server, which may allow handles to point to different user states, leading to more privileged access.(CVE-2021-3738)

A flaw was found in the way that samba as an AD domain controller can support RODC. This will allow RODC to print administrator credentials.(CVE-2020-25718)

A flaw was discovered in the way that Samba, as an AD domain controller, implements Kerberos name-based authentication. If Samba AD DC does not strictly require Kerberos PAC and always uses the SID found in it, it may not be able to distinguish the user represented by the credential.(CVE-2020-25719)

The AD Kerberos acceptance service in Samba cannot perform authorization by accessing the user's unique and long-term stable identifier.(CVE-2020-25721)

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2016-2124	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-25722	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2021-3738	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-25718	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-25719	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2020-25721	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "samba-winbind-modules-4.11.12-8.oe1.aarch64.rpm",
          "samba-4.11.12-8.oe1.aarch64.rpm",
          "libwbclient-4.11.12-8.oe1.aarch64.rpm",
          "samba-winbind-4.11.12-8.oe1.aarch64.rpm",
          "libsmbclient-4.11.12-8.oe1.aarch64.rpm",
          "python3-samba-4.11.12-8.oe1.aarch64.rpm",
          "libwbclient-devel-4.11.12-8.oe1.aarch64.rpm",
          "libsmbclient-devel-4.11.12-8.oe1.aarch64.rpm",
          "samba-winbind-krb5-locator-4.11.12-8.oe1.aarch64.rpm",
          "samba-client-4.11.12-8.oe1.aarch64.rpm",
          "ctdb-tests-4.11.12-8.oe1.aarch64.rpm",
          "samba-krb5-printing-4.11.12-8.oe1.aarch64.rpm",
          "ctdb-4.11.12-8.oe1.aarch64.rpm",
          "samba-debugsource-4.11.12-8.oe1.aarch64.rpm",
          "samba-debuginfo-4.11.12-8.oe1.aarch64.rpm",
          "samba-dc-provision-4.11.12-8.oe1.aarch64.rpm",
          "samba-devel-4.11.12-8.oe1.aarch64.rpm",
          "samba-help-4.11.12-8.oe1.aarch64.rpm",
          "samba-dc-4.11.12-8.oe1.aarch64.rpm",
          "python3-samba-dc-4.11.12-8.oe1.aarch64.rpm",
          "samba-dc-bind-dlz-4.11.12-8.oe1.aarch64.rpm",
          "samba-libs-4.11.12-8.oe1.aarch64.rpm",
          "samba-winbind-clients-4.11.12-8.oe1.aarch64.rpm",
          "samba-common-4.11.12-8.oe1.aarch64.rpm",
          "samba-test-4.11.12-8.oe1.aarch64.rpm",
          "python3-samba-test-4.11.12-8.oe1.aarch64.rpm",
          "samba-common-tools-4.11.12-8.oe1.aarch64.rpm"
        ],
        "noarch": [
          "samba-pidl-4.11.12-8.oe1.noarch.rpm"
        ],
        "src": [
          "samba-4.11.12-8.oe1.src.rpm"
        ],
        "x86_64": [
          "samba-vfs-glusterfs-4.11.12-8.oe1.x86_64.rpm",
          "samba-dc-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-krb5-locator-4.11.12-8.oe1.x86_64.rpm",
          "samba-4.11.12-8.oe1.x86_64.rpm",
          "ctdb-4.11.12-8.oe1.x86_64.rpm",
          "samba-debuginfo-4.11.12-8.oe1.x86_64.rpm",
          "samba-common-4.11.12-8.oe1.x86_64.rpm",
          "libsmbclient-devel-4.11.12-8.oe1.x86_64.rpm",
          "samba-dc-bind-dlz-4.11.12-8.oe1.x86_64.rpm",
          "samba-krb5-printing-4.11.12-8.oe1.x86_64.rpm",
          "libwbclient-4.11.12-8.oe1.x86_64.rpm",
          "samba-devel-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-4.11.12-8.oe1.x86_64.rpm",
          "libwbclient-devel-4.11.12-8.oe1.x86_64.rpm",
          "samba-client-4.11.12-8.oe1.x86_64.rpm",
          "samba-debugsource-4.11.12-8.oe1.x86_64.rpm",
          "samba-dc-provision-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-clients-4.11.12-8.oe1.x86_64.rpm",
          "python3-samba-test-4.11.12-8.oe1.x86_64.rpm",
          "samba-common-tools-4.11.12-8.oe1.x86_64.rpm",
          "python3-samba-dc-4.11.12-8.oe1.x86_64.rpm",
          "samba-test-4.11.12-8.oe1.x86_64.rpm",
          "python3-samba-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-modules-4.11.12-8.oe1.x86_64.rpm",
          "samba-help-4.11.12-8.oe1.x86_64.rpm",
          "libsmbclient-4.11.12-8.oe1.x86_64.rpm",
          "ctdb-tests-4.11.12-8.oe1.x86_64.rpm",
          "samba-libs-4.11.12-8.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "samba",
        "purl": "pkg:rpm/openEuler/samba\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.11.12-8.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libwbclient-4.11.12-8.oe1.aarch64.rpm",
          "samba-winbind-krb5-locator-4.11.12-8.oe1.aarch64.rpm",
          "python3-samba-4.11.12-8.oe1.aarch64.rpm",
          "samba-winbind-modules-4.11.12-8.oe1.aarch64.rpm",
          "samba-dc-provision-4.11.12-8.oe1.aarch64.rpm",
          "samba-help-4.11.12-8.oe1.aarch64.rpm",
          "samba-libs-4.11.12-8.oe1.aarch64.rpm",
          "samba-krb5-printing-4.11.12-8.oe1.aarch64.rpm",
          "ctdb-4.11.12-8.oe1.aarch64.rpm",
          "python3-samba-dc-4.11.12-8.oe1.aarch64.rpm",
          "samba-4.11.12-8.oe1.aarch64.rpm",
          "samba-debugsource-4.11.12-8.oe1.aarch64.rpm",
          "samba-devel-4.11.12-8.oe1.aarch64.rpm",
          "ctdb-tests-4.11.12-8.oe1.aarch64.rpm",
          "samba-dc-bind-dlz-4.11.12-8.oe1.aarch64.rpm",
          "samba-winbind-4.11.12-8.oe1.aarch64.rpm",
          "samba-winbind-clients-4.11.12-8.oe1.aarch64.rpm",
          "samba-debuginfo-4.11.12-8.oe1.aarch64.rpm",
          "samba-client-4.11.12-8.oe1.aarch64.rpm",
          "samba-test-4.11.12-8.oe1.aarch64.rpm",
          "libsmbclient-4.11.12-8.oe1.aarch64.rpm",
          "libsmbclient-devel-4.11.12-8.oe1.aarch64.rpm",
          "samba-common-4.11.12-8.oe1.aarch64.rpm",
          "libwbclient-devel-4.11.12-8.oe1.aarch64.rpm",
          "python3-samba-test-4.11.12-8.oe1.aarch64.rpm",
          "samba-dc-4.11.12-8.oe1.aarch64.rpm",
          "samba-common-tools-4.11.12-8.oe1.aarch64.rpm"
        ],
        "noarch": [
          "samba-pidl-4.11.12-8.oe1.noarch.rpm"
        ],
        "src": [
          "samba-4.11.12-8.oe1.src.rpm"
        ],
        "x86_64": [
          "samba-dc-4.11.12-8.oe1.x86_64.rpm",
          "samba-test-4.11.12-8.oe1.x86_64.rpm",
          "python3-samba-test-4.11.12-8.oe1.x86_64.rpm",
          "samba-dc-provision-4.11.12-8.oe1.x86_64.rpm",
          "samba-krb5-printing-4.11.12-8.oe1.x86_64.rpm",
          "samba-vfs-glusterfs-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-modules-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-krb5-locator-4.11.12-8.oe1.x86_64.rpm",
          "libwbclient-devel-4.11.12-8.oe1.x86_64.rpm",
          "samba-dc-bind-dlz-4.11.12-8.oe1.x86_64.rpm",
          "ctdb-4.11.12-8.oe1.x86_64.rpm",
          "samba-help-4.11.12-8.oe1.x86_64.rpm",
          "samba-common-4.11.12-8.oe1.x86_64.rpm",
          "samba-common-tools-4.11.12-8.oe1.x86_64.rpm",
          "ctdb-tests-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-clients-4.11.12-8.oe1.x86_64.rpm",
          "samba-debugsource-4.11.12-8.oe1.x86_64.rpm",
          "samba-devel-4.11.12-8.oe1.x86_64.rpm",
          "samba-debuginfo-4.11.12-8.oe1.x86_64.rpm",
          "samba-client-4.11.12-8.oe1.x86_64.rpm",
          "libwbclient-4.11.12-8.oe1.x86_64.rpm",
          "samba-4.11.12-8.oe1.x86_64.rpm",
          "libsmbclient-devel-4.11.12-8.oe1.x86_64.rpm",
          "libsmbclient-4.11.12-8.oe1.x86_64.rpm",
          "samba-libs-4.11.12-8.oe1.x86_64.rpm",
          "python3-samba-4.11.12-8.oe1.x86_64.rpm",
          "samba-winbind-4.11.12-8.oe1.x86_64.rpm",
          "python3-samba-dc-4.11.12-8.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP2",
        "name": "samba",
        "purl": "pkg:rpm/openEuler/samba\u0026distro=openEuler-20.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.11.12-8.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was discovered in the way samba implements SMB1 authentication. Even if Kerberos authentication is required, an attacker can use this flaw to retrieve the clear text password sent over the wire.(CVE-2016-2124)\r\n\r\nSeveral flaws were found in the way that samba AD DC implements storage data access and consistency checking. Attackers can use this flaw to cause damage to the entire domain.(CVE-2020-25722)\r\n\r\nA use-after-free issue was found in the Samba AD DC RPC server, which may allow handles to point to different user states, leading to more privileged access.(CVE-2021-3738)\r\n\r\nA flaw was found in the way that samba as an AD domain controller can support RODC. This will allow RODC to print administrator credentials.(CVE-2020-25718)\r\n\r\nA flaw was discovered in the way that Samba, as an AD domain controller, implements Kerberos name-based authentication. If Samba AD DC does not strictly require Kerberos PAC and always uses the SID found in it, it may not be able to distinguish the user represented by the credential.(CVE-2020-25719)\r\n\r\nThe AD Kerberos acceptance service in Samba cannot perform authorization by accessing the user\u0027s unique and long-term stable identifier.(CVE-2020-25721)",
  "id": "OESA-2021-1461",
  "modified": "2026-08-06T11:04:44Z",
  "published": "2021-12-10T11:04:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1461"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2124"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25722"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3738"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25718"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25719"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25721"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "samba security update",
  "upstream": [
    "CVE-2016-2124",
    "CVE-2020-25722",
    "CVE-2021-3738",
    "CVE-2020-25718",
    "CVE-2020-25719",
    "CVE-2020-25721"
  ]
}

CVE-2016-2124 (GCVE-0-2016-2124)

Vulnerability from cvelistv5 – Published: 2022-02-18 00:00 – Updated: 2024-08-05 23:17

Summary

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

Severity

No CVSS data available.

CWE

CWE-287

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2019660
https://www.samba.org/samba/security/CVE-2016-2124.html
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202309-06	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	samba	Affected: samba 4.15.2, samba 4.14.10, samba 4.13.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:17:50.581Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019660"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.samba.org/samba/security/CVE-2016-2124.html"
          },
          {
            "name": "[debian-lts-announce] 20230914 [SECURITY] [DLA 3563-1] samba security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html"
          },
          {
            "name": "GLSA-202309-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202309-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "samba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "samba 4.15.2, samba 4.14.10, samba 4.13.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-17T08:06:48.847Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019660"
        },
        {
          "url": "https://www.samba.org/samba/security/CVE-2016-2124.html"
        },
        {
          "name": "[debian-lts-announce] 20230914 [SECURITY] [DLA 3563-1] samba security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html"
        },
        {
          "name": "GLSA-202309-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202309-06"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2124",
    "datePublished": "2022-02-18T00:00:00.000Z",
    "dateReserved": "2016-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:17:50.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25718 (GCVE-0-2020-25718)

Vulnerability from cvelistv5 – Published: 2022-02-18 00:00 – Updated: 2024-08-04 15:40

Summary

A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.

Severity

No CVSS data available.

CWE

CWE-862

Assigner

redhat redhat root

References

3 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2019726
https://www.samba.org/samba/security/CVE-2020-257…
https://security.gentoo.org/glsa/202309-06	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	samba	Affected: samba 4.15.2, samba 4.14.10, samba 4.13.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.803Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019726"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.samba.org/samba/security/CVE-2020-25718.html"
          },
          {
            "name": "GLSA-202309-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202309-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "samba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "samba 4.15.2, samba 4.14.10, samba 4.13.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-17T08:06:27.389Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019726"
        },
        {
          "url": "https://www.samba.org/samba/security/CVE-2020-25718.html"
        },
        {
          "name": "GLSA-202309-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202309-06"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25718",
    "datePublished": "2022-02-18T00:00:00.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:40:36.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25719 (GCVE-0-2020-25719)

Vulnerability from cvelistv5 – Published: 2022-02-18 00:00 – Updated: 2024-08-04 15:40

Summary

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

Severity

No CVSS data available.

CWE

CWE-287

Assigner

redhat redhat root

References

3 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2019732
https://www.samba.org/samba/security/CVE-2020-257…
https://security.gentoo.org/glsa/202309-06	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	samba	Affected: samba 4.15.2, samba 4.14.10, samba 4.13.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.654Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019732"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.samba.org/samba/security/CVE-2020-25719.html"
          },
          {
            "name": "GLSA-202309-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202309-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "samba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "samba 4.15.2, samba 4.14.10, samba 4.13.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-17T08:06:50.287Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019732"
        },
        {
          "url": "https://www.samba.org/samba/security/CVE-2020-25719.html"
        },
        {
          "name": "GLSA-202309-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202309-06"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25719",
    "datePublished": "2022-02-18T00:00:00.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:40:36.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25721 (GCVE-0-2020-25721)

Vulnerability from cvelistv5 – Published: 2022-03-16 00:00 – Updated: 2024-08-04 15:40

Summary

Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.

Severity

No CVSS data available.

CWE

CWE-20 - (Improper Input validation)

Assigner

redhat redhat root

References

4 references

URL	Tags
https://www.samba.org/samba/security/CVE-2020-257…
https://bugzilla.samba.org/show_bug.cgi?id=14725
https://bugzilla.redhat.com/show_bug.cgi?id=2021728
https://security.gentoo.org/glsa/202309-06	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	samba	Affected: Affected - All versions since Samba 4.0.0, Fixed-In - v4.15.2, v4.14.10 and v4.13.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.samba.org/samba/security/CVE-2020-25721.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.samba.org/show_bug.cgi?id=14725"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2021728"
          },
          {
            "name": "GLSA-202309-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202309-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "samba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Affected - All versions since Samba 4.0.0, Fixed-In - v4.15.2, v4.14.10 and v4.13.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 (Improper Input validation)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-17T08:06:24.438Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://www.samba.org/samba/security/CVE-2020-25721.html"
        },
        {
          "url": "https://bugzilla.samba.org/show_bug.cgi?id=14725"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2021728"
        },
        {
          "name": "GLSA-202309-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202309-06"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25721",
    "datePublished": "2022-03-16T00:00:00.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:40:36.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25722 (GCVE-0-2020-25722)

Vulnerability from cvelistv5 – Published: 2022-02-18 00:00 – Updated: 2024-08-04 15:40

Summary

Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.

Severity

No CVSS data available.

CWE

CWE-863

Assigner

redhat redhat root

References

3 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2019764
https://www.samba.org/samba/security/CVE-2020-257…
https://security.gentoo.org/glsa/202309-06	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	samba	Affected: samba 4.15.2, samba 4.14.10, samba 4.13.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.640Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019764"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.samba.org/samba/security/CVE-2020-25722.html"
          },
          {
            "name": "GLSA-202309-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202309-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "samba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "samba 4.15.2, samba 4.14.10, samba 4.13.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-17T08:06:41.461Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019764"
        },
        {
          "url": "https://www.samba.org/samba/security/CVE-2020-25722.html"
        },
        {
          "name": "GLSA-202309-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202309-06"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25722",
    "datePublished": "2022-02-18T00:00:00.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:40:36.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3738 (GCVE-0-2021-3738)

Vulnerability from cvelistv5 – Published: 2022-03-02 00:00 – Updated: 2024-08-03 17:01

Summary

In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.

Severity

No CVSS data available.

CWE

CWE-416 - - Use After Free

Assigner

redhat redhat root

References

4 references

URL	Tags
https://www.samba.org/samba/security/CVE-2021-3738.html
https://bugzilla.samba.org/show_bug.cgi?id=14468
https://bugzilla.redhat.com/show_bug.cgi?id=2021726
https://security.gentoo.org/glsa/202309-06	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	samba	Affected: Affects all versions since samba 4.0 \| Fixedin samba v4.15.2, v4.14.10 and v4.13.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:07.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.samba.org/samba/security/CVE-2021-3738.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.samba.org/show_bug.cgi?id=14468"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2021726"
          },
          {
            "name": "GLSA-202309-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202309-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "samba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Affects all versions since samba 4.0 | Fixedin samba v4.15.2, v4.14.10 and v4.13.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called \u0027association groups\u0027. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid \u0027struct session_info\u0027. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 - Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-17T08:06:18.717Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://www.samba.org/samba/security/CVE-2021-3738.html"
        },
        {
          "url": "https://bugzilla.samba.org/show_bug.cgi?id=14468"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2021726"
        },
        {
          "name": "GLSA-202309-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202309-06"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3738",
    "datePublished": "2022-03-02T00:00:00.000Z",
    "dateReserved": "2021-08-26T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:01:07.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2021-1461 (CVE-2016-2124)

CVE-2016-2124 (GCVE-0-2016-2124)

CVE-2020-25718 (GCVE-0-2020-25718)

CVE-2020-25719 (GCVE-0-2020-25719)

CVE-2020-25721 (GCVE-0-2020-25721)

CVE-2020-25722 (GCVE-0-2020-25722)

CVE-2021-3738 (GCVE-0-2021-3738)

Tags

Sightings

Nomenclature

Related by attack behaviour