PT-2023-6233 · Samba+7 · Samba+7

Andrew Bartlett · Published 2023-10-03 · Updated 2024-11-15 · CVE-2023-4154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samba (affected versions not specified)

Description A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the issue fails to account for error conditions, like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Information Disclosure

Weakness Enumeration

CWE-787

CWE-200

Related Identifiers

ALT-PU-2023-6448

ALT-PU-2023-7794

ALT-PU-2024-12484

ALT-PU-2024-14683

AZL-31955

AZL-37026

BDU:2023-06942

CVE-2023-4154

DSA-5525-1

OPENSUSE-SU-2023_4046-1

OPENSUSE-SU-2023_4059-1

OPENSUSE-SU-2024:13332-1

SUSE-SU-2023:4046-1

SUSE-SU-2023:4059-1

SUSE-SU-2023:4096-1

USN-6425-1

USN-6425-2

USN-6425-3

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Red Os

Samba

Suse

Ubuntu

References · 59

• https://ubuntu.com/security/notices/USN-6425-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4154 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4154 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06942 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-4154 · Security Note
• https://ubuntu.com/security/CVE-2023-4154 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-4154 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/715195 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13332-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4091 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-4154 · Vendor Advisory
• https://samba.org/samba/security/CVE-2023-4154.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-6425-2 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5525-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42669 · Vendor Advisory