Samba Missing ACL Vulnerability (CVE-2020-25720)

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.114865");
  script_version("2024-11-26T07:35:52+0000");
  script_tag(name:"last_modification", value:"2024-11-26 07:35:52 +0000 (Tue, 26 Nov 2024)");
  script_tag(name:"creation_date", value:"2024-11-22 14:37:56 +0000 (Fri, 22 Nov 2024)");
  script_tag(name:"cvss_base", value:"7.1");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:H/Au:S/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2024-11-17 11:15:04 +0000 (Sun, 17 Nov 2024)");

  script_cve_id("CVE-2020-25720");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba Missing ACL Vulnerability (CVE-2020-25720)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Samba is prone to a missing access control list (ACL)
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"A vulnerability was found in Samba where a delegated
  administrator with permission to create objects in Active Directory can write to all attributes of
  the newly created object, including security-sensitive attributes, even after the object's
  creation. This issue occurs because the administrator owns the object due to the lack of an Access
  Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The
  retained significant rights of the delegated administrator may not be well understood, potentially
  leading to unintended privilege escalation or security risks.");

  # nb: Taken from the Bugzilla entry as there seems to be no samba/security/CVE-2020-25720.html
  # entry available (yet).
  script_tag(name:"affected", value:"Samba version starting from 4.1 and prior to 4.17.7.");

  script_tag(name:"solution", value:"Update to version 4.17.7 or later.");

  # nb: While Samba 4.18.1 has been released at the same time then 4.17.7 it seems 4.18.x wasn't
  # affected because the fix got merged into the "master" 2 years ago which got later 4.18.x.
  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.17.7.html");
  script_xref(name:"URL", value:"https://bugzilla.samba.org/show_bug.cgi?id=14810");
  script_xref(name:"URL", value:"https://gitlab.com/samba-team/samba/-/merge_requests/2514");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range_exclusive(version: version, test_version_lo: "4.1.0", test_version_up: "4.17.7")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.17.7", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);