Samba AD DC did not correctly sandbox

Description

Samba as an Active Directory Domain Controller is able to support an
RODC, which is meant to have minimal privileges in a domain.

However, in accepting a ticket from a Samba or Windows RODC, Samba
was not confirming that the RODC is authorized to print such a ticket,
via the msDS-NeverRevealGroup and msDS-RevealOnDemandGroup (typically
“Allowed RODC Replication Group” and “Denied RODC Replciation
Group”).

This would allow an RODC to print administrator tickets.

Patch Availability

Patches addressing both these issues have been posted to:

https://www.samba.org/samba/security/

Additionally, Samba 4.15.2, 4.14.10 and 4.13.14 have been issued
as security releases to correct the defect. Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

CVSSv3 calculation

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5)

Workaround

Credits

Originally reported by Andrew Bartlett.

Patches provided by:

• Andrew Bartlett of Catalyst and the Samba Team.
• Douglas Bagnall of Catalyst and the Samba Team.
• Joseph Sutton of Catalyst and the Samba Team

Catalyst wishes to thank Univention Gmbh in particular for their
support towards the production of this fix.

Advisory written by Andrew Bartlett of Catalyst

== Our Code, Our Bugs, Our Responsibility.
== The Samba Team