A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Mar 26, 2024 | Nov 7, 2023 |
| Debian | — | Upgrade samba | Oct 19, 2023 | Oct 19, 2023 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Feb 21, 2024 | Nov 7, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libsmbclientUpgrade samba-winbind-modulesUpgrade samba-winbindUpgrade samba-winbind-clientsUpgrade libwbclientUpgrade samba-common-toolsUpgrade samba-libsUpgrade samba-clientUpgrade samba-commonUpgrade samba | Jan 10, 2024 | Nov 7, 2023 |
| Samba | — | Upgrade to Samba 4.17.12 or later.Upgrade to Samba 4.19.1 or later.Upgrade to Samba 4.18.8 or later. | Nov 7, 2023 | Nov 7, 2023 |
| Suse | — | Upgrade samba-winbindUpgrade samba-ad-dc-libs-32bitUpgrade samba-libs-python3Upgrade samba-dsdb-modulesUpgrade samba-winbind-libs-32bitUpgrade samba-libsUpgrade samba-python3Upgrade samba-testUpgrade samba-winbind-libsUpgrade libsamba-policy-develUpgrade samba-client-libsUpgrade samba-docUpgrade samba-ad-dcUpgrade samba-ad-dc-libsUpgrade ctdb-pcp-pmdaUpgrade samba-libs-python3-32bitUpgrade samba-ldb-ldapUpgrade samba-develUpgrade ctdbUpgrade samba-libs-32bitUpgrade libsamba-policy0-python3Upgrade sambaUpgrade samba-cephUpgrade samba-client-libs-32bitUpgrade samba-clientUpgrade samba-toolUpgrade samba-gpupdateUpgrade libsamba-policy-python3-develUpgrade samba-client-32bitUpgrade samba-devel-32bitUpgrade libsamba-policy0-python3-32bit | Oct 12, 2023 | Oct 11, 2023 |
| Ubuntu | — | Upgrade samba | Oct 11, 2023 | Oct 10, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub