A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-ipaclientUpgrade custodiaUpgrade python3-jwcryptoUpgrade ipa-healthcheckUpgrade ipa-client-epnUpgrade ipa-client-sambaUpgrade opendnssecUpgrade ipa-commonUpgrade ipa-server-commonUpgrade python3-ipatestsUpgrade softhsm-develUpgrade python3-custodiaUpgrade python3-ipaserverUpgrade ipa-python-compatUpgrade bind-dyndb-ldapUpgrade softhsmUpgrade ipa-serverUpgrade ipa-clientUpgrade python3-qrcode-coreUpgrade python3-yubicoUpgrade ipa-selinuxUpgrade ipa-server-dnsUpgrade slapi-nisUpgrade python3-pyusbUpgrade python3-ipalibUpgrade ipa-healthcheck-coreUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade python3-qrcodeUpgrade python3-kdcproxy | May 4, 2022 | Feb 18, 2022 |
| Alpine Linux | — | Upgrade samba | Mar 26, 2024 | Feb 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade python2-ipaclientUpgrade ipa-clientUpgrade ipa-server-trust-adUpgrade python2-ipalibUpgrade ipa-python-compatUpgrade ipa-serverUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade ipa-commonUpgrade ipa-server-commonUpgrade ipa-server-dnsUpgrade python2-ipaserver | Jul 21, 2023 | Feb 18, 2022 |
| Centos_linux | — | Upgrade ipa-healthcheck-coreUpgrade ipa-server-trust-adUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-server-commonUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-debuginfoUpgrade softhsm-debugsourceUpgrade opendnssec-debugsourceUpgrade slapi-nis-debuginfoUpgrade ipa-client-commonUpgrade python3-ipaclientUpgrade python2-ipaserverUpgrade ipa-client-sambaUpgrade python3-pyusbUpgrade custodiaUpgrade bind-dyndb-ldapUpgrade softhsm-debuginfoUpgrade python3-ipaserverUpgrade ipa-selinuxUpgrade python3-ipalibUpgrade python3-qrcodeUpgrade python3-ipatestsUpgrade python3-jwcryptoUpgrade ipa-healthcheckUpgrade python3-yubicoUpgrade python3-custodiaUpgrade slapi-nisUpgrade opendnssecUpgrade slapi-nis-debugsourceUpgrade python3-kdcproxyUpgrade ipa-debugsourceUpgrade ipa-server-debuginfoUpgrade softhsmUpgrade ipa-clientUpgrade softhsm-develUpgrade python3-qrcode-coreUpgrade opendnssec-debuginfoUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade python2-ipalibUpgrade python2-ipaclientUpgrade ipa-python-compatUpgrade ipa-client-epn | Dec 16, 2021 | Dec 15, 2021 |
| Debian | — | Upgrade samba | Nov 4, 2022 | Feb 18, 2022 |
| Freebsd | — | Upgrade samba415Upgrade samba414Upgrade samba413 | Nov 4, 2022 | Nov 10, 2021 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Feb 18, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade samba-commonUpgrade libsmbclientUpgrade sambaUpgrade samba-common-toolsUpgrade samba-winbind-clientsUpgrade samba-winbindUpgrade samba-winbind-modulesUpgrade samba-clientUpgrade samba-libsUpgrade libwbclient | Feb 28, 2022 | Feb 18, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libsmbclientUpgrade samba-commonUpgrade samba-winbindUpgrade samba-winbind-clientsUpgrade samba-libsUpgrade samba-common-toolsUpgrade sambaUpgrade samba-winbind-modulesUpgrade libwbclientUpgrade samba-client | Mar 3, 2022 | Feb 18, 2022 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Feb 17, 2022 |
| Oracle_linux | — | Upgrade python3-custodiaUpgrade bind-dyndb-ldapUpgrade python2-ipaclientUpgrade ipa-healthcheck-coreUpgrade python3-kdcproxyUpgrade ipa-client-commonUpgrade python3-pyusbUpgrade python3-ipalibUpgrade softhsm-develUpgrade ipa-server-trust-adUpgrade custodiaUpgrade python3-qrcode-coreUpgrade ipa-server-dnsUpgrade opendnssecUpgrade ipa-server-commonUpgrade softhsmUpgrade ipa-python-compatUpgrade python2-ipalibUpgrade python3-qrcodeUpgrade python3-jwcryptoUpgrade python3-yubicoUpgrade python2-ipaserverUpgrade ipa-selinuxUpgrade python3-ipaserverUpgrade ipa-healthcheckUpgrade python3-ipaclientUpgrade ipa-client-sambaUpgrade ipa-serverUpgrade ipa-client-epnUpgrade ipa-clientUpgrade slapi-nisUpgrade python3-ipatestsUpgrade ipa-common | Dec 17, 2021 | Nov 9, 2021 |
| Redhat_linux | — | Upgrade ipa-server-trust-ad-debuginfoUpgrade ipa-server-commonUpgrade python3-ipaclientUpgrade bind-dyndb-ldapUpgrade ipa-client-epnUpgrade custodiaUpgrade python3-jwcryptoUpgrade ipa-server-dnsUpgrade python3-qrcodeUpgrade ipa-client-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade python3-ipaserverUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade ipa-client-sambaUpgrade ipa-selinuxUpgrade python3-ipalibUpgrade ipa-clientUpgrade python3-ipatestsUpgrade python3-kdcproxyUpgrade ipa-debugsourceUpgrade ipa-commonUpgrade python2-ipalibUpgrade softhsm-debugsourceUpgrade python3-yubicoUpgrade ipa-debuginfoUpgrade opendnssec-debugsourceUpgrade opendnssec-debuginfoUpgrade ipa-idoverride-memberof-pluginUpgrade python2-ipaclientUpgrade ipa-server-debuginfoUpgrade python3-custodiaUpgrade ipa-server-trust-adUpgrade python3-pyusbUpgrade python2-ipaserverUpgrade slapi-nis-debugsourceUpgrade python3-qrcode-coreUpgrade softhsmUpgrade softhsm-develUpgrade ipa-healthcheckUpgrade slapi-nisUpgrade ipa-healthcheck-coreUpgrade ipa-client-commonUpgrade opendnssecUpgrade slapi-nis-debuginfoUpgrade ipa-python-compatUpgrade ipa-server | Dec 16, 2021 | Dec 15, 2021 |
| Rocky_linux | — | Upgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-epnUpgrade ipa-client-sambaUpgrade ipa-server-trust-ad-debuginfoUpgrade slapi-nisUpgrade slapi-nis-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-server-trust-adUpgrade softhsmUpgrade ipa-serverUpgrade opendnssecUpgrade opendnssec-debuginfoUpgrade ipa-debugsourceUpgrade ipa-clientUpgrade opendnssec-debugsourceUpgrade ipa-debuginfoUpgrade softhsm-develUpgrade softhsm-debugsourceUpgrade ipa-server-debuginfoUpgrade bind-dyndb-ldap | Mar 12, 2024 | Feb 18, 2022 |
| Samba | — | Upgrade to Samba 4.14.10 or later.Upgrade to Samba 4.15.2 or later.Upgrade to Samba 4.13.14 or later. | Mar 10, 2022 | Feb 18, 2022 |
| Suse | — | Upgrade libsmbconf0-64bitUpgrade libtevent-util-develUpgrade libndr-standard-develUpgrade samba-libs-32bitUpgrade libdcerpc0-64bitUpgrade libsmbldap2Upgrade libsmbconf-develUpgrade libsamba-errors-develUpgrade samba-libsUpgrade libsmbldap2-64bitUpgrade libndr-nbt0-64bitUpgrade libndr-standard0Upgrade libsamba-credentials0-32bitUpgrade sambaUpgrade samba-client-32bitUpgrade samba-testUpgrade libnetapi0Upgrade libsmbconf0-32bitUpgrade libsmbclient0Upgrade libndr-krb5pac0-64bitUpgrade libndr1Upgrade libdcerpc-samr0Upgrade samba-ad-dc-32bitUpgrade python3-ldb-32bitUpgrade libsamba-util0-32bitUpgrade libnetapi-develUpgrade libdcerpc-binding0-64bitUpgrade libldb2Upgrade libdcerpc-develUpgrade ctdbUpgrade ldb-toolsUpgrade libtevent-util0Upgrade libsamdb0-32bitUpgrade libsamba-util0Upgrade samba-cephUpgrade libsamba-policy0-python3Upgrade libwbclient0-64bitUpgrade libsamba-util0-64bitUpgrade samba-clientUpgrade samba-winbind-64bitUpgrade samba-ad-dc-64bitUpgrade libsamba-policy0-python3-64bitUpgrade libsamba-passdb-develUpgrade libnetapi0-64bitUpgrade libsamba-hostconfig0Upgrade libdcerpc-samr0-32bitUpgrade libdcerpc0-32bitUpgrade libdcerpc-samr0-64bitUpgrade libndr-standard0-64bitUpgrade libndr-nbt0Upgrade libsmbclient0-32bitUpgrade libsmbclient-develUpgrade samba-client-64bitUpgrade libsamba-errors0-32bitUpgrade libsamba-policy0-python3-32bitUpgrade libsmbconf0Upgrade libndr-krb5pac0-32bitUpgrade libtevent-util0-64bitUpgrade libsamba-util-develUpgrade libsamba-policy-python3-develUpgrade libwbclient0Upgrade libsmbldap2-32bitUpgrade libsamba-credentials0Upgrade libsamdb-develUpgrade samba-ad-dcUpgrade libnetapi0-32bitUpgrade libsamba-hostconfig-develUpgrade libsamba-passdb0Upgrade samba-winbindUpgrade libdcerpc-binding0-32bitUpgrade libdcerpc-samr-develUpgrade libndr-nbt0-32bitUpgrade libndr-standard0-32bitUpgrade libndr-develUpgrade python3-ldbUpgrade libnetapi-devel-32bitUpgrade samba-libs-64bitUpgrade libldb2-32bitUpgrade libldb-develUpgrade samba-ldb-ldapUpgrade libsamba-hostconfig0-64bitUpgrade libtevent-util0-32bitUpgrade libwbclient0-32bitUpgrade libwbclient-develUpgrade libsamba-hostconfig0-32bitUpgrade libndr-krb5pac-develUpgrade libdcerpc0Upgrade samba-libs-python3-64bitUpgrade libsamba-passdb0-32bitUpgrade libndr-nbt-develUpgrade libsmbclient0-64bitUpgrade samba-winbind-32bitUpgrade libsmbldap-develUpgrade libsamdb0Upgrade libsamba-policy-develUpgrade samba-python3Upgrade ctdb-pcp-pmdaUpgrade libdcerpc-binding0Upgrade libsamba-credentials0-64bitUpgrade libndr1-64bitUpgrade libsamba-errors0Upgrade ctdb-testsUpgrade samba-dsdb-modulesUpgrade libsamba-passdb0-64bitUpgrade samba-docUpgrade libsamdb0-64bitUpgrade libsamba-credentials-develUpgrade libnetapi-devel-64bitUpgrade samba-libs-python3Upgrade python3-ldb-develUpgrade libndr1-32bitUpgrade libsamba-errors0-64bitUpgrade samba-core-develUpgrade libndr-krb5pac0Upgrade samba-libs-python3-32bitUpgrade samba-gpupdate | Nov 11, 2021 | Nov 10, 2021 |
| Ubuntu | — | Upgrade samba | Nov 12, 2021 | Nov 10, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub