CVE-2023-4154 Samba: ad dc password exposure to privileged users and rodcs

What is CVE-2023-4154?

CVE-2023-4154 is a high-severity vulnerability in Samba Samba, published on 7 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.

Weakness: CWE-787

Which versions are affected by CVE-2023-4154?

It affects 1 product.

Products include Samba Samba.

How do I fix CVE-2023-4154?

Apply the vendor's patch.

Is CVE-2023-4154 being exploited?

There is no known exploitation of CVE-2023-4154 in the wild and no public exploit code.

Other vulnerabilities in Samba Samba

• CVE-2012-1182 Integer overflow in n/a Critical 10.0
• CVE-2007-2446 Memory corruption in n/a Critical 10.0
• CVE-2004-0600 Memory corruption in n/a Critical 10.0
• CVE-1999-0810 Denial of service in n/a Critical 10.0
• CVE-1999-0182 Memory corruption in n/a Critical 10.0

All Samba Samba vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-4154, AZL-31955, AZL-37026, DEBIAN-CVE-2023-4154, ECHO-366e-1e8f-df2c, GHSA-v5f6-rpxq-xvg8 and 1 more.