A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-trust-adUpgrade python3-kdcproxyUpgrade python3-ipalibUpgrade python3-pyusbUpgrade ipa-healthcheck-coreUpgrade ipa-client-commonUpgrade slapi-nisUpgrade python3-qrcodeUpgrade ipa-server-dnsUpgrade ipa-clientUpgrade python3-yubicoUpgrade ipa-serverUpgrade bind-dyndb-ldapUpgrade python3-qrcode-coreUpgrade ipa-python-compatUpgrade ipa-server-commonUpgrade python3-ipaserverUpgrade python3-ipaclientUpgrade ipa-client-epnUpgrade ipa-selinuxUpgrade softhsmUpgrade opendnssecUpgrade ipa-client-sambaUpgrade python3-custodiaUpgrade ipa-healthcheckUpgrade python3-jwcryptoUpgrade python3-ipatestsUpgrade custodiaUpgrade softhsm-develUpgrade ipa-common | May 4, 2022 | Feb 18, 2022 |
| Alpine Linux | — | Upgrade samba | Mar 26, 2024 | Feb 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade ipa-clientUpgrade ipa-client-commonUpgrade python2-ipaclientUpgrade python2-ipalibUpgrade ipa-commonUpgrade ipa-python-compatUpgrade ipa-debuginfoUpgrade ipa-serverUpgrade ipa-server-trust-adUpgrade ipa-server-dnsUpgrade python2-ipaserverUpgrade ipa-server-common | Jul 21, 2023 | Feb 18, 2022 |
| Centos_linux | — | Upgrade softhsm-develUpgrade ipa-debugsourceUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade ipa-clientUpgrade ipa-python-compatUpgrade python3-custodiaUpgrade ipa-serverUpgrade python3-qrcode-coreUpgrade ipa-commonUpgrade slapi-nisUpgrade python2-ipaclientUpgrade opendnssec-debuginfoUpgrade slapi-nis-debugsourceUpgrade python2-ipalibUpgrade ipa-server-debuginfoUpgrade python3-kdcproxyUpgrade softhsmUpgrade ipa-client-epnUpgrade python3-yubicoUpgrade opendnssecUpgrade python3-qrcodeUpgrade python3-pyusbUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-healthcheckUpgrade bind-dyndb-ldapUpgrade ipa-selinuxUpgrade python3-jwcryptoUpgrade ipa-server-commonUpgrade slapi-nis-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-client-sambaUpgrade custodiaUpgrade python3-ipatestsUpgrade python3-ipaclientUpgrade python2-ipaserverUpgrade opendnssec-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-client-commonUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-server-trust-adUpgrade python3-ipalibUpgrade softhsm-debugsourceUpgrade ipa-healthcheck-coreUpgrade softhsm-debuginfoUpgrade python3-ipaserver | Dec 16, 2021 | Dec 15, 2021 |
| Debian | — | Upgrade samba | Nov 4, 2022 | Feb 18, 2022 |
| Freebsd | — | Upgrade samba414Upgrade samba413Upgrade samba415 | Nov 4, 2022 | Nov 10, 2021 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Feb 18, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade samba-libsUpgrade libwbclientUpgrade samba-clientUpgrade sambaUpgrade samba-winbind-clientsUpgrade samba-commonUpgrade samba-common-toolsUpgrade libsmbclientUpgrade samba-winbindUpgrade samba-winbind-modules | Feb 28, 2022 | Feb 18, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade samba-commonUpgrade sambaUpgrade samba-winbindUpgrade samba-common-toolsUpgrade samba-libsUpgrade samba-winbind-modulesUpgrade samba-clientUpgrade libwbclientUpgrade samba-winbind-clientsUpgrade libsmbclient | Mar 3, 2022 | Feb 18, 2022 |
| Oracle Solaris | — | Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Feb 17, 2022 |
| Oracle_linux | — | Upgrade ipa-serverUpgrade python3-ipatestsUpgrade python3-ipaclientUpgrade python3-yubicoUpgrade python3-jwcryptoUpgrade python3-ipaserverUpgrade ipa-selinuxUpgrade ipa-clientUpgrade ipa-healthcheckUpgrade ipa-client-epnUpgrade ipa-client-sambaUpgrade python2-ipaserverUpgrade slapi-nisUpgrade ipa-commonUpgrade ipa-client-commonUpgrade python3-qrcodeUpgrade ipa-python-compatUpgrade python2-ipalibUpgrade python3-kdcproxyUpgrade ipa-healthcheck-coreUpgrade python3-qrcode-coreUpgrade python3-pyusbUpgrade opendnssecUpgrade ipa-server-dnsUpgrade python3-custodiaUpgrade python3-ipalibUpgrade softhsm-develUpgrade bind-dyndb-ldapUpgrade custodiaUpgrade softhsmUpgrade ipa-server-commonUpgrade ipa-server-trust-adUpgrade python2-ipaclient | Dec 17, 2021 | Nov 9, 2021 |
| Redhat_linux | — | Upgrade python3-ipalibUpgrade ipa-clientUpgrade ipa-client-commonUpgrade opendnssec-debugsourceUpgrade python3-kdcproxyUpgrade softhsm-debugsourceUpgrade ipa-debugsourceUpgrade ipa-commonUpgrade python3-yubicoUpgrade python3-custodiaUpgrade python2-ipalibUpgrade ipa-healthcheckUpgrade ipa-healthcheck-coreUpgrade ipa-python-compatUpgrade slapi-nis-debugsourceUpgrade slapi-nis-debuginfoUpgrade python3-pyusbUpgrade opendnssecUpgrade python2-ipaserverUpgrade slapi-nisUpgrade python3-qrcode-coreUpgrade softhsmUpgrade python2-ipaclientUpgrade ipa-server-debuginfoUpgrade opendnssec-debuginfoUpgrade ipa-debuginfoUpgrade ipa-serverUpgrade python3-ipatestsUpgrade softhsm-develUpgrade ipa-server-trust-adUpgrade ipa-idoverride-memberof-pluginUpgrade python3-ipaclientUpgrade ipa-client-debuginfoUpgrade ipa-client-epnUpgrade softhsm-debuginfoUpgrade ipa-server-commonUpgrade custodiaUpgrade ipa-server-dnsUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade python3-qrcodeUpgrade python3-jwcryptoUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-sambaUpgrade python3-ipaserverUpgrade ipa-selinuxUpgrade bind-dyndb-ldap | Dec 16, 2021 | Dec 15, 2021 |
| Rocky_linux | — | Upgrade ipa-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-debuginfoUpgrade ipa-server-debuginfoUpgrade opendnssec-debugsourceUpgrade softhsm-debugsourceUpgrade opendnssec-debuginfoUpgrade softhsm-develUpgrade ipa-server-trust-adUpgrade bind-dyndb-ldapUpgrade ipa-clientUpgrade ipa-serverUpgrade opendnssecUpgrade softhsmUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-sambaUpgrade slapi-nis-debugsourceUpgrade slapi-nis-debuginfoUpgrade softhsm-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debuginfoUpgrade slapi-nis | Mar 12, 2024 | Feb 18, 2022 |
| Samba | — | Upgrade to Samba 4.13.14 or later.Upgrade to Samba 4.14.10 or later.Upgrade to Samba 4.15.2 or later. | Mar 10, 2022 | Feb 18, 2022 |
| Suse | — | Upgrade libsamba-passdb0-32bitUpgrade samba-winbindUpgrade libsamba-passdb0Upgrade libndr-standard0-32bitUpgrade libndr-nbt0-32bitUpgrade libsamba-hostconfig0-32bitUpgrade samba-libs-python3-64bitUpgrade samba-gpupdateUpgrade libwbclient-develUpgrade libsamba-credentials-develUpgrade libdcerpc-binding0-32bitUpgrade samba-ldb-ldapUpgrade libndr-nbt-develUpgrade samba-python3Upgrade libsamba-errors0Upgrade libwbclient0-32bitUpgrade libsmbclient0-64bitUpgrade libdcerpc-samr-develUpgrade libndr-krb5pac-develUpgrade libdcerpc0Upgrade ctdb-pcp-pmdaUpgrade libtevent-util0-32bitUpgrade samba-ad-dcUpgrade libnetapi0-32bitUpgrade libsamdb0-64bitUpgrade libndr-krb5pac0Upgrade libldb2-32bitUpgrade libnetapi-devel-64bitUpgrade libsamba-passdb0-64bitUpgrade libndr1-32bitUpgrade samba-core-develUpgrade samba-winbind-32bitUpgrade libndr-develUpgrade libdcerpc-binding0Upgrade ctdb-testsUpgrade libsamba-credentials0-64bitUpgrade libsamdb0Upgrade samba-libs-64bitUpgrade libsamba-errors0-64bitUpgrade libsamba-policy-develUpgrade samba-libs-python3-32bitUpgrade python3-ldb-develUpgrade libsamba-hostconfig-develUpgrade samba-libs-python3Upgrade libsamba-hostconfig0-64bitUpgrade libsmbldap-develUpgrade libnetapi-devel-32bitUpgrade libndr1-64bitUpgrade libldb-develUpgrade samba-docUpgrade samba-dsdb-modulesUpgrade python3-ldbUpgrade samba-clientUpgrade libwbclient0-64bitUpgrade libsamba-util-develUpgrade libndr-krb5pac0-32bitUpgrade libdcerpc0-32bitUpgrade libndr-standard0Upgrade libsmbldap2-64bitUpgrade libsamba-errors-develUpgrade libsmbldap2Upgrade libndr-nbt0-64bitUpgrade libsmbconf-develUpgrade libsamdb0-32bitUpgrade samba-libs-32bitUpgrade libdcerpc-samr0-64bitUpgrade libldb2Upgrade libnetapi-develUpgrade samba-client-32bitUpgrade libsamdb-develUpgrade libsamba-credentials0Upgrade libnetapi0-64bitUpgrade libndr-standard-develUpgrade sambaUpgrade libsmbconf0-64bitUpgrade libdcerpc-samr0-32bitUpgrade libsamba-policy0-python3-64bitUpgrade libnetapi0Upgrade libtevent-util-develUpgrade samba-libsUpgrade libndr-standard0-64bitUpgrade libndr1Upgrade libdcerpc-binding0-64bitUpgrade libsmbconf0Upgrade libsamba-util0-64bitUpgrade libndr-krb5pac0-64bitUpgrade libsamba-util0-32bitUpgrade samba-ad-dc-64bitUpgrade samba-cephUpgrade libsmbclient0-32bitUpgrade samba-testUpgrade libsmbclient0Upgrade libsamba-credentials0-32bitUpgrade libsmbldap2-32bitUpgrade samba-winbind-64bitUpgrade libsmbconf0-32bitUpgrade libdcerpc-develUpgrade libtevent-util0-64bitUpgrade libtevent-util0Upgrade ldb-toolsUpgrade libdcerpc0-64bitUpgrade libsamba-policy0-python3-32bitUpgrade libsamba-policy-python3-develUpgrade samba-ad-dc-32bitUpgrade libsamba-policy0-python3Upgrade libwbclient0Upgrade libsmbclient-develUpgrade ctdbUpgrade libndr-nbt0Upgrade libsamba-errors0-32bitUpgrade libdcerpc-samr0Upgrade python3-ldb-32bitUpgrade samba-client-64bitUpgrade libsamba-passdb-develUpgrade libsamba-util0Upgrade libsamba-hostconfig0 | Nov 11, 2021 | Nov 10, 2021 |
| Ubuntu | — | Upgrade samba | Nov 12, 2021 | Nov 10, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub