CVE-2020-25719 Auth bypass in samba
Samba AD DC allows domain compromise via Kerberos name-based authentication flaws when PAC is not strictly required.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25719?
CVE-2020-25719 is a high-severity authentication bypass vulnerability in Canonical Ubuntu Linux, published on 18 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.
Which versions are affected by CVE-2020-25719?
It affects 17 products.
Linux distribution packages (40)
bind-dyndb-ldap AlmaLinux:8 | All versions | 11.6-2.module_el8.5.0+2603+92118e57 |
custodia AlmaLinux:8 | All versions | 0.6.0-3.module_el8.5.0+2603+92118e57 |
custodia AlmaLinux:8 | All versions | 0.6.0-3.module_el8.6.0+2881+2f24dc92 |
ipa-client AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-client-common AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-client-epn AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-client-samba AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-common AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-healthcheck AlmaLinux:8 | All versions | 0.7-6.module_el8.5.0+2603+92118e57 |
ipa-healthcheck-core AlmaLinux:8 | All versions | 0.7-6.module_el8.5.0+2603+92118e57 |
ipa-python-compat AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-selinux AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-server AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-server-common AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-server-dns AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
ipa-server-trust-ad AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
opendnssec AlmaLinux:8 | All versions | 2.1.7-1.module_el8.5.0+2603+92118e57 |
opendnssec AlmaLinux:8 | All versions | 2.1.7-1.module_el8.6.0+2881+2f24dc92 |
python3-custodia AlmaLinux:8 | All versions | 0.6.0-3.module_el8.5.0+2603+92118e57 |
python3-custodia AlmaLinux:8 | All versions | 0.6.0-3.module_el8.6.0+2881+2f24dc92 |
python3-ipaclient AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
python3-ipalib AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
python3-ipaserver AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
python3-ipatests AlmaLinux:8 | All versions | 4.9.6-10.module_el8.5.0+2603+92118e57 |
python3-jwcrypto AlmaLinux:8 | All versions | 0.5.0-1.module_el8.5.0+2603+92118e57 |
python3-jwcrypto AlmaLinux:8 | All versions | 0.5.0-1.module_el8.6.0+2737+7e73ea90 |
python3-jwcrypto AlmaLinux:8 | All versions | 0.5.0-1.module_el8.6.0+2881+2f24dc92 |
python3-kdcproxy AlmaLinux:8 | All versions | 0.4-5.module_el8.5.0+2603+92118e57 |
python3-kdcproxy AlmaLinux:8 | All versions | 0.4-5.module_el8.6.0+2881+2f24dc92 |
python3-pyusb AlmaLinux:8 | All versions | 1.0.0-9.module_el8.5.0+2603+92118e57 |
python3-pyusb AlmaLinux:8 | All versions | 1.0.0-9.module_el8.6.0+2737+7e73ea90 |
python3-pyusb AlmaLinux:8 | All versions | 1.0.0-9.module_el8.6.0+2881+2f24dc92 |
python3-qrcode AlmaLinux:8 | All versions | 5.1-12.module_el8.5.0+2603+92118e57 |
python3-qrcode AlmaLinux:8 | All versions | 5.1-12.module_el8.6.0+2737+7e73ea90 |
python3-qrcode AlmaLinux:8 | All versions | 5.1-12.module_el8.6.0+2881+2f24dc92 |
python3-qrcode-core AlmaLinux:8 | All versions | 5.1-12.module_el8.5.0+2603+92118e57 |
python3-qrcode-core AlmaLinux:8 | All versions | 5.1-12.module_el8.6.0+2737+7e73ea90 |
python3-qrcode-core AlmaLinux:8 | All versions | 5.1-12.module_el8.6.0+2881+2f24dc92 |
python3-yubico AlmaLinux:8 | All versions | 1.3.2-9.module_el8.5.0+2603+92118e57 |
python3-yubico AlmaLinux:8 | All versions | 1.3.2-9.module_el8.6.0+2737+7e73ea90 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus and 11 more.
How do I fix CVE-2020-25719?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-25719 being exploited?
There is no known exploitation of CVE-2020-25719 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2020-25719, ALSA-2021:5142, AZL-36995, AZL-8704, DEBIAN-CVE-2020-25719, ECHO-a223-d6f2-08e2 and 7 more.