CVE-2020-25718
published 2022-02-18CVE-2020-25718: A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC…
PriorityP346high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.59%
73.2th percentile
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.13.14+dfsg-1 (bookworm) | samba 2:4.13.14+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| msrc | azl3_samba_4.18.3-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_samba_4.12.5-6_on_cbl_mariner_2.0 | — | — |
| samba | samba | — | — |
| samba | samba | >= 0 < 2:4.13.13+dfsg-1~deb11u2 | 2:4.13.13+dfsg-1~deb11u2 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-1 | 2:4.13.14+dfsg-1 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-1 | 2:4.13.14+dfsg-1 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-1 | 2:4.13.14+dfsg-1 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-0ubuntu0.20.04.4 | 2:4.13.14+dfsg-0ubuntu0.20.04.4 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-0ubuntu0.20.04.3 | 2:4.13.14+dfsg-0ubuntu0.20.04.3 |
| samba | samba | >= 0 < 2:4.13.14+dfsg-0ubuntu0.20.04.1 | 2:4.13.14+dfsg-0ubuntu0.20.04.1 |
| samba | samba | >= 4.0.0 < 4.13.14 | 4.13.14 |
| samba | samba | >= 4.14.0 < 4.14.10 | 4.14.10 |
| samba | samba | >= 4.15.0 < 4.15.2 | 4.15.2 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
A flaw was found in the way samba as an Active Directory Domain Controller is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
vendor_msrc·2022-02-08·CVSS 8.8
CVE-2020-25718 [HIGH] CWE-862 A flaw was found in the way samba as an Active Directory Domain Controller is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
A flaw was found in the way samba as an Active Directory Domain Controller is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to ref
Ubuntu
Samba regression
vendor_ubuntu·2021-12-13·CVSS 5.9
[MEDIUM] Samba regression
Title: Samba regression
Summary: USN-5142-1 introduced a regression in Samba.
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced a regression in Kerberos authentication in certain environments.
Please see the following upstream bug for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14922
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
An
Ubuntu
Samba regressions
vendor_ubuntu·2021-12-06·CVSS 5.9
[MEDIUM] Samba regressions
Title: Samba regressions
Summary: USN-5142-1 introduced regressions in Samba.
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced regressions in name mapping and backups.
Please see the following upstream bugs for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14901
https://bugzilla.samba.org/show_bug.cgi?id=14918
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain mem
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2021-11-11·CVSS 5.9
CVE-2020-25721 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos
tickets issues by an RODC. An RODC could print administrator tickets,
contrary to expectations. (CVE-2020-25718)
Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets.
Delegated administrators could possibly use this issu
Red Hat
samba: Samba AD DC did not correctly sandbox Kerberos tickets issues by an RODC
vendor_redhat·2021-11-09·CVSS 8.8
CVE-2020-25718 [HIGH] CWE-862 samba: Samba AD DC did not correctly sandbox Kerberos tickets issues by an RODC
samba: Samba AD DC did not correctly sandbox Kerberos tickets issues by an RODC
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
Package: samba (Red Hat Enterprise Linux 6) - Not affected
Package: samba4 (Red Hat Enterprise Linux 6) - Not affected
Package: samba (Red Hat Enterprise Linux 7) - Not affected
Package: samba (Red Hat Enterprise Linux 8) - Not affected
Package: samba (Red Hat Enterprise Linux 9) - Not affected
Package: samba (Red Hat Storage
Debian
CVE-2020-25718: samba - A flaw was found in the way samba, as an Active Directory Domain Controller, is ...
vendor_debian·2020·CVSS 8.8
CVE-2020-25718 [HIGH] CVE-2020-25718: samba - A flaw was found in the way samba, as an Active Directory Domain Controller, is ...
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
Scope: local
bookworm: resolved (fixed in 2:4.13.14+dfsg-1)
bullseye: resolved (fixed in 2:4.13.13+dfsg-1~deb11u2)
forky: resolved (fixed in 2:4.13.14+dfsg-1)
sid: resolved (fixed in 2:4.13.14+dfsg-1)
trixie: resolved (fixed in 2:4.13.14+dfsg-1)
GHSA
GHSA-xrvp-6c6f-cv37: A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller)
ghsa_unreviewed·2022-02-19
CVE-2020-25718 [HIGH] CWE-732 GHSA-xrvp-6c6f-cv37: A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller)
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
OSV
CVE-2020-25718: A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller)
osv·2022-02-18·CVSS 8.8
CVE-2020-25718 [HIGH] CVE-2020-25718: A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller)
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
OSV
samba regression
osv·2021-12-13·CVSS 5.9
[MEDIUM] samba regression
samba regression
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced a regression in Kerberos authentication in certain environments.
Please see the following upstream bug for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14922
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba did not correctly sandbox
OSV
samba regressions
osv·2021-12-06·CVSS 5.9
[MEDIUM] samba regressions
samba regressions
USN-5142-1 fixed vulnerabilities in Samba. Some of the upstream changes
introduced regressions in name mapping and backups.
Please see the following upstream bugs for more information:
https://bugzilla.samba.org/show_bug.cgi?id=14901
https://bugzilla.samba.org/show_bug.cgi?id=14918
This update fixes the problem.
Original advisory details:
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba
OSV
samba vulnerabilities
osv·2021-11-11·CVSS 5.9
CVE-2016-2124 [MEDIUM] samba vulnerabilities
samba vulnerabilities
Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client
connections. A remote attacker could possibly use this issue to downgrade
connections to plaintext authentication. (CVE-2016-2124)
Andrew Bartlett discovered that Samba incorrectly mapping domain users to
local users. An authenticated attacker could possibly use this issue to
become root on domain members. (CVE-2020-25717)
Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos
tickets issues by an RODC. An RODC could print administrator tickets,
contrary to expectations. (CVE-2020-25718)
Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets.
Delegated administrators could possibly use this issue to impersonate
accounts, leading to total domain compromise.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-18
Published