{"id":"CVE-2023-4154","state":"PUBLISHED","title":"Samba: ad dc password exposure to privileged users and rodcs","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","publishedAt":"2023-11-07T19:14:28.305Z","updatedAt":"2024-08-02T07:17:12.144Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["n/a samba","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Storage 3","Fedora Fedora"],"affected":[{"vendor":"n/a","product":"samba","versions":[{"version":"4.19.1","status":"unaffected"},{"version":"4.18.8","status":"unaffected"},{"version":"4.17.12","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"samba4","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Storage 3","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:storage:3"]},{"vendor":"Fedora","product":"Fedora","packageName":"samba","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":["https://access.redhat.com/security/cve/CVE-2023-4154","https://bugzilla.redhat.com/show_bug.cgi?id=2241883","https://bugzilla.samba.org/show_bug.cgi?id=15424","https://security.netapp.com/advisory/ntap-20231124-0002/","https://www.samba.org/samba/security/CVE-2023-4154.html"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4154.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-4154","state":"PUBLISHED","datePublished":"2023-11-07T19:14:28.305Z","dateUpdated":"2024-08-02T07:17:12.144Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-08-04T13:22:07.200Z"},"containers":{"cna":{"title":"Samba: ad dc password exposure to privileged users and rodcs","descriptions":[{"lang":"en","value":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence."}],"affected":[{"vendor":"n/a","product":"samba","versions":[{"version":"4.19.1","status":"unaffected"},{"version":"4.18.8","status":"unaffected"},{"version":"4.17.12","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"samba4","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Storage 3","packageName":"samba","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:storage:3"]},{"vendor":"Fedora","product":"Fedora","packageName":"samba","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-4154","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241883","name":"RHBZ#2241883","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=15424"},{"url":"https://security.netapp.com/advisory/ntap-20231124-0002/"},{"url":"https://www.samba.org/samba/security/CVE-2023-4154.html"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2024-01-23T01:33:49.736Z"},"datePublic":"2023-10-10T00:00:00.000Z","x_redhatCweChain":"CWE-787: Out-of-bounds Write","timeline":[{"lang":"en","time":"2023-10-03T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-10-10T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-4154","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241883","name":"RHBZ#2241883","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=15424","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20231124-0002/","tags":["x_transferred"]},{"url":"https://www.samba.org/samba/security/CVE-2023-4154.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:17:12.144Z"}}]}}}