Andrew Bartlett

**Name of the Vulnerable Software and Affected Versions** Active Directory Domain Services (affected versions not specified) **Description** The issue is related to a lack of protection for service data in Active Directory Domain Services, which can be exploited by a remote attacker to disclose protected information. This allows attackers to obtain sensitive information and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the `GET CHANGES` right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital `krbtgt`, effectively eliminating the RODC / DC distinction. Furthermore, the issue fails to account for error conditions, like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This issue stems from an RPC function that can be blocked indefinitely, causing service disruptions. The disruption is triggered by a "sleep()" call in the `dcesrv echo TestSleep()` function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** The issue is related to the Samba AD DC administration tool sending new or reset passwords over a signed-only connection when operating against a remote LDAP server. This could allow a remote attacker to obtain newly set passwords if they can observe the network traffic between samba-tool and the Samba AD DC, especially when connected using a Kerberos secured LDAP connection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** The issue is related to the default permission settings in Samba, a network communication package. It may allow a remote attacker to compromise data integrity. Specifically, Samba does not validate the `Validated-DNS-Host-Name` right for the `dNSHostName` attribute, which could permit unprivileged users to write it. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** The issue is related to a use-after-free problem in the Samba AD LDAP server, specifically in the AD DC database audit logging module. This module can access LDAP message values that have been freed by a preceding database module. The issue can be exploited when modifying certain privileged attributes, such as `userAccountControl`. Exploitation of this issue may allow a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to errors in privilege management in the implementation of the Kerberos protocol in Windows operating systems. It allows a remote attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Workstation Service (affected versions not specified) **Description** A security-feature bypass issue allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security feature bypass in the Local Security Authority (Domain Policy) Remote Protocol, which can be exploited by a remote attacker to disclose protected information. This is due to weaknesses in the authorization mechanism of the Windows operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to the implementation of the Windows BackupKey protocol in Windows operating systems, which is associated with information disclosure. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information. It is a security-feature bypass vulnerability that allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Server versions prior to the patchday that contains the fix for the vulnerability **Description** The issue is related to an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services. This vulnerability is associated with insecure privilege management, which can be exploited by a remote attacker to elevate their privileges. The vulnerability is linked to the Privilege Attribute Certificate (PAC) in the Kerberos authentication protocol, which stores additional user authorization information. Microsoft updated the PAC by adding two new data structures, PAC ATTRIBUTES INFO and PAC REQUESTOR, to address this issue. The PAC REQUESTOR structure checks the username in the ticket, which is resolved to a SID included in the PAC. As a result, any ticket without the new PAC structure (or a ticket for a non-existent user) will be rejected if the update is installed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Server versions prior to the fixed version Microsoft Active Directory Domain Services (affected versions not specified) **Description** The issue is related to insecure privilege management in Active Directory Domain Services, allowing a remote attacker to elevate privileges in the system. This is an elevation-of-privilege vulnerability that can affect the system. **Recommendations** For Microsoft Windows Server versions prior to the fixed version, update to the latest version to resolve the issue. For Microsoft Active Directory Domain Services, consider restricting access to sensitive areas of the system until a patch is available. As a temporary workaround, consider disabling any features that rely on privilege escalation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Active Directory Domain Services (affected versions not specified) **Description** The issue is related to insecure privilege management in the Active Directory Domain Services component of the Windows operating system. This allows a remote attacker to potentially elevate their privileges. The vulnerability can be exploited by an attacker to affect the system. In certain configurations, such as when an Owner has rights on the DC object and without specific protections in place, the Owner can grant themselves or others any desired rights via implicit WriteDACL. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba (affected versions not specified) **Description** The issue is related to the MaxQueryDuration not being honored in Samba AD DC LDAP, which can lead to uncontrolled resource consumption. This can allow a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DAViCal Andrew's Web Libraries (AWL) versions through 0.60 **Description** An issue in DAViCal Andrew's Web Libraries (AWL) allows for a brute-force attack due to insecure generation of long-term session cookies, which are used for long-term session continuity. This could enable a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. **Recommendations** For versions through 0.60, as a temporary workaround, consider implementing additional security measures to protect against brute-force attacks on long-term session cookies until a secure method of generating these cookies is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DAViCal Andrew's Web Libraries (AWL) versions through 0.60 **Description** The issue concerns a problem with session management in DAViCal Andrew's Web Libraries (AWL), where the session key is not sufficiently hard to guess. This allows an attacker to potentially impersonate a session if they can guess the microsecond time and the incrementing session id. The vulnerability may allow a remote attacker to access confidential data. **Recommendations** For versions through 0.60, consider implementing additional security measures to protect session management, such as using more secure session keys or implementing rate limiting to prevent brute-force guessing of session IDs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba versions 4.8.x up to, excluding 4.8.12 Samba versions 4.9.x up to, excluding 4.9.8 Samba versions 4.10.x up to, excluding 4.10.3 **Description** A flaw was found in Samba's Heimdal KDC implementation when used in AD DC mode, allowing a man-in-the-middle attacker to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC, effectively obtaining a ticket for that principal. The issue is related to improper checksum validation in the S4U2Self extension, which can allow attackers to elevate their privileges and access privileged resources. **Recommendations** For Samba versions 4.8.x up to, excluding 4.8.12, update to version 4.8.12 or later to resolve the issue. For Samba versions 4.9.x up to, excluding 4.9.8, update to version 4.9.8 or later to resolve the issue. For Samba versions 4.10.x up to, excluding 4.10.3, update to version 4.10.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Heimdal KDC implementation to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Samba versions 4.0.x through 4.0.23 Samba versions 4.1.x through 4.1.15 Samba versions 4.2.x through 4.2rc3 **Description** The issue is related to the configuration of an Active Directory Domain Controller (AD DC) in Samba, which allows remote authenticated users to gain privileges by setting the LDB userAccountControl UF SERVER TRUST ACCOUNT bit. This is due to a lack of control over privileges and access management. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For Samba versions 4.0.x through 4.0.23, update to version 4.0.24 or later. For Samba versions 4.1.x through 4.1.15, update to version 4.1.16 or later. For Samba versions 4.2.x through 4.2rc3, update to version 4.2rc4 or later.

**Name of the Vulnerable Software and Affected Versions** Libevent versions 2.0.x through 2.0.21 Libevent versions 2.1.x through 2.1.4-beta **Description** The issue is caused by multiple integer overflows in the evbuffer API, which can lead to a heap-based buffer overflow or an infinite loop when "insanely large inputs" are provided to certain functions, including `evbuffer add`, `evbuffer prepend`, `evbuffer expand`, `exbuffer reserve space`, or `evbuffer read`. This can allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact. **Recommendations** For Libevent versions 2.0.x through 2.0.21, update to version 2.0.22 or later. For Libevent versions 2.1.x through 2.1.4-beta, update to version 2.1.5-beta or later. As a temporary workaround, consider restricting the input size to the `evbuffer add`, `evbuffer prepend`, `evbuffer expand`, `exbuffer reserve space`, and `evbuffer read` functions to prevent "insanely large inputs" from being processed.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista version SP2 Microsoft Windows Server 2008 versions SP2 through R2 SP1 Microsoft Windows Server 2012 versions Gold through R2 **Description** The issue is related to the Security Account Manager Remote (SAMR) protocol implementation, which does not properly determine the user-lockout state. This makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack. **Recommendations** For Microsoft Windows XP versions SP2 through SP3, update the system to address the SAMR security feature bypass issue. For Microsoft Windows Server 2003 version SP2, apply the necessary patch to fix the SAMR protocol implementation. For Microsoft Windows Vista version SP2, install the latest security update to resolve the issue. For Microsoft Windows Server 2008 versions SP2 through R2 SP1, apply the recommended hotfix to mitigate the vulnerability. For Microsoft Windows Server 2012 versions Gold through R2, update the system with the latest security patches to address the SAMR security feature bypass issue.