A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2019732 | patch third party advisory issue tracking |
| https://www.samba.org/samba/security/CVE-2020-25719.html | mitigation vendor advisory |
| https://security.gentoo.org/glsa/202309-06 | vendor advisory |