CVE-2023-4154

NameCVE-2023-4154
DescriptionA design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5525-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
samba (PTS)buster2:4.9.5+dfsg-5+deb10u3vulnerable
buster (security)2:4.9.5+dfsg-5+deb10u5vulnerable
bullseye2:4.13.13+dfsg-1~deb11u5vulnerable
bullseye (security)2:4.13.13+dfsg-1~deb11u6vulnerable
bookworm, bookworm (security)2:4.17.12+dfsg-0+deb12u1fixed
trixie2:4.20.1+dfsg-1fixed
sid2:4.20.1+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sambasourcebookworm2:4.17.12+dfsg-0+deb12u1DSA-5525-1
sambasource(unstable)2:4.19.1+dfsg-1

Notes

[bullseye] - samba <ignored> (Domain controller functionality is EOLed, see DSA DSA-5477-1)
[buster] - samba <ignored> (Domain controller functionality is EOLed, see DSA-5015-1)
https://www.samba.org/samba/security/CVE-2023-4154.html

Search for package or bug name: Reporting problems