CVE-2020-25721 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Yes
Type	Privilege escalation
Description	A security issue has been found in Samba versions 4.0.0 to 4.15.1. Samba as an AD DC did not provide a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-2538	samba	4.15.1-1	4.15.2-1	Medium	Fixed

References
https://www.samba.org/samba/security/CVE-2020-25721.html https://www.samba.org/samba/ftp/patches/security/samba-4.15.1-security-2021-11-09.patch

Notes
Workaround ========== It would be prudent to pre-create disabled users in Active Directory matching on all privileged names not held in Active Directory, eg samba-tool user add root -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password samba-tool user add ubuntu -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password ... (repeat for eg all system users under 1000 in /etc/passwd or special to any other AD-connected services, eg perhaps "admin" for a web-app) If running a Microsoft Windows Active Directory, setting ms-DS-MachineAccountQuota to 0, in the Active Directory domain would be advised, if possible.

Notes

Workaround
==========

It would be prudent to pre-create disabled users in Active Directory matching on all privileged names not held in Active Directory, eg

 samba-tool user add root -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password
 samba-tool user add ubuntu -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password
 ...
 (repeat for eg all system users under 1000 in /etc/passwd or special to any other AD-connected services, eg perhaps "admin" for a web-app)

If running a Microsoft Windows Active Directory, setting ms-DS-MachineAccountQuota to 0, in the Active Directory domain would be advised, if possible.