PT-2021-5158 · Samba+5 · Samba+5

Huzaifa S. Sidhpurwala · Published 2021-11-09 · Updated 2024-06-15 · CVE-2020-25718

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samba (affected versions not specified)

Description The issue is related to the support of RODC (read-only domain controller) functionality in Samba when it acts as an Active Directory Domain Controller. This could allow a remote attacker to elevate their privileges, potentially enabling them to print administrator tickets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

ALT-PU-2021-3247

ALT-PU-2021-3296

ALT-PU-2021-3339

ALT-PU-2021-3470

AZL-36994

AZL-8766

BDU:2021-05958

CVE-2020-25718

DSA-5003-1

ECHO-AA14-DBF1-ECA8

MGASA-2021-0585

OESA-2021-1461

OPENSUSE-SU-2021:3647-1

OPENSUSE-SU-2021_3647-1

OPENSUSE-SU-2024:11631-1

SUSE-SU-2021:3647-1

SUSE-SU-2022:0361-1

USN-5142-1

USN-5142-2

USN-5142-3

Affected Products

Alt Linux

Astra Linux

Linuxmint

Samba

Suse

Ubuntu

References · 93

• https://security-tracker.debian.org/tracker/CVE-2020-25718 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5142-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25722 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25718 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25718 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-25718 · Vendor Advisory
• https://samba.org/samba/security/CVE-2020-25718.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25718 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-8766 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:3647-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3647-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25722 · Security Note
• https://ubuntu.com/security/CVE-2020-25721 · Vendor Advisory