Rapid7 Vulnerability & Exploit Database

Samba CVE-2019-14870: DelegationNotAllowed not being enforced in protocol transition on Samba AD DC.

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

Samba CVE-2019-14870: DelegationNotAllowed not being enforced in protocol transition on Samba AD DC.

Severity
6
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
Published
12/10/2019
Created
12/17/2019
Added
12/16/2019
Modified
12/20/2019

Description

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

Solution(s)

  • samba-upgrade-4_10_11
  • samba-upgrade-4_11_3
  • samba-upgrade-4_9_17

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;