A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.

An update of the samba package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in Samba where a delegated administrator with permission to create objects in     Active Directory can write to all attributes of the newly created object, including security-sensitive     attributes, even after the object's creation. This issue occurs because the administrator owns the object     due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the     'creator owner.' The retained significant rights of the delegated administrator may not be well     understood, potentially leading to unintended privilege escalation or security risks. (CVE-2020-25720)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-190 advisory.

    An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

    A user with sufficient privileges to create a computer account, such as a user granted CreateChild     permissions for computer objects, may potentially set arbitrary values on security-sensitive attributes of     specific objects stored in Active Directory (AD). (CVE-2020-25720)

    Samba AD DC dnsHostname attribute can be deleted by unprivileged authenticated users. (CVE-2023-0225)

    Access controlled AD LDAP attributes can be discovered (CVE-2023-0614)

    Samba AD DC admin tool samba-tool sends passwords in cleartext (CVE-2023-0922)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-206 advisory.

    An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

    A user with sufficient privileges to create a computer account, such as a user granted CreateChild     permissions for computer objects, may potentially set arbitrary values on security-sensitive attributes of     specific objects stored in Active Directory (AD). (CVE-2020-25720)

    Samba AD DC dnsHostname attribute can be deleted by unprivileged authenticated users. (CVE-2023-0225)

    Access controlled AD LDAP attributes can be discovered (CVE-2023-0614)

    Samba AD DC admin tool samba-tool sends passwords in cleartext (CVE-2023-0922)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333968	Photon OS 5.0: Samba PHSA-2023-5.0-91-0037	Nessus	PhotonOS Local Security Checks	Local	high
229887	Linux Distros Unpatched Vulnerability : CVE-2020-25720	Nessus	Misc.	Local	high
204532	Photon OS 5.0: Samba PHSA-2023-5.0-0037	Nessus	PhotonOS Local Security Checks	Local	high
204501	Photon OS 4.0: Samba PHSA-2023-4.0-0417	Nessus	PhotonOS Local Security Checks	Local	high
203873	Photon OS 3.0: Samba PHSA-2023-3.0-0603	Nessus	PhotonOS Local Security Checks	Local	critical
176934	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-190)	Nessus	Amazon Linux Local Security Checks	Local	high
176912	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-206)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2020-25720

high

Tenable Plugins

high

high

high

high

critical

high

high