Vulnerability · Published Nov 7, 2023 · Assigned by redhat
CVE-2023-4154Samba: ad dc password exposure to privileged users and rodcs
High 7.5
In plain English
A high-severity out-of-bounds write in Fedora from Fedora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | samba | 4.18.8-r0 | ALPINE-CVE-2023-4154 |
| Alpine:v3.21 | samba | 4.18.8-r0 | ALPINE-CVE-2023-4154 |
| Alpine:v3.22 | samba | 4.18.8-r0 | ALPINE-CVE-2023-4154 |
| Alpine:v3.23 | samba | 4.18.8-r0 | ALPINE-CVE-2023-4154 |
| Alpine:v3.24 | samba | 4.18.8-r0 | ALPINE-CVE-2023-4154 |
| Debian:12 | samba | 2:4.17.12+dfsg-0+deb12u1 | DSA-5525-1 |
| Debian:12 | samba | 2:4.17.12+dfsg-0+deb12u1 | DEBIAN-CVE-2023-4154 |
| Debian:13 | samba | 2:4.19.1+dfsg-1 | DEBIAN-CVE-2023-4154 |
| Debian:14 | samba | 2:4.19.1+dfsg-1 | DEBIAN-CVE-2023-4154 |
| Ubuntu:22.04:LTS | samba | 2:4.15.13+dfsg-0ubuntu1.5 | USN-6425-1 |
| Ubuntu:22.04:LTS | samba | 2:4.15.13+dfsg-0ubuntu1.5 | UBUNTU-CVE-2023-4154 |
| Ubuntu:24.04:LTS | samba | 2:4.18.6+dfsg-1ubuntu2.1 | UBUNTU-CVE-2023-4154 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | samba | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Storage 3 | see references |
| Fedora | Fedora | see references |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2023-4154 vdb-entry, x_refsource_REDHAT
- RHBZ#2241883 issue-tracking, x_refsource_REDHAT
- https://bugzilla.samba.org/show_bug.cgi?id=15424
- https://security.netapp.com/advisory/ntap-20231124-0002/
- https://www.samba.org/samba/security/CVE-2023-4154.html