CVE-2020-25719 – samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets

https://notcve.org/view.php?id=CVE-2020-25719

11 Nov 2021 — A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise. Se encontró un fallo en la forma en que Samba, como controlador de dominio de Active Directory, implementaba la autenticación basada en nombres de Kerberos. El AD DC de Samba, pod... • https://bugzilla.redhat.com/show_bug.cgi?id=2019732 • CWE-287: Improper Authentication CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •

CVE-2021-23192 – samba: Subsequent DCE/RPC fragment injection vulnerability

https://notcve.org/view.php?id=CVE-2021-23192

11 Nov 2021 — A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements. Se ha encontrado un fallo en la forma en que samba implementa DCE/RPC. Si un cliente a un servidor Samba enviaba una petición DCE/RPC muy grande, y elegía fragmentarla, un atacante podía reemplazar los fragmentos posteriores con sus propios datos, omitiendo los req... • https://bugzilla.redhat.com/show_bug.cgi?id=2019666 • CWE-20: Improper Input Validation •

CVE-2020-25718 – Gentoo Linux Security Advisory 202309-06

https://notcve.org/view.php?id=CVE-2020-25718

11 Nov 2021 — A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets. Se encontró un fallo en la forma en que samba, como controlador de dominio de Active Directory, es capaz de soportar un RODC (controlador de dominio de sólo lectura). Esto permitiría a un RODC imprimir tickets de administrador Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote... • https://bugzilla.redhat.com/show_bug.cgi?id=2019726 • CWE-862: Missing Authorization •

CVE-2020-17049 – Kerberos KDC Security Feature Bypass Vulnerability

https://notcve.org/view.php?id=CVE-2020-17049

11 Nov 2020 —

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).

To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Vulnerabilidad d... • http://www.openwall.com/lists/oss-security/2021/11/10/3 • CWE-345: Insufficient Verification of Data Authenticity CWE-863: Incorrect Authorization •