5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
8.7 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.451 Medium
EPSS
Percentile
97.4%
Tom Tervoort discovered that the Netlogon protocol implemented by Samba
incorrectly handled the authentication scheme. A remote attacker could use
this issue to forge an authentication token and steal the credentials of
the domain admin.
While a previous security update fixed the issue by changing the “server
schannel” setting to default to “yes”, instead of “auto”, which forced a
secure netlogon channel, this update provides additional improvements.
For compatibility reasons with older devices, Samba now allows specifying
an insecure netlogon configuration per machine. See the following link for
examples: <https://www.samba.org/samba/security/>CVE-2020-1472.html
In addition, this update adds additional server checks for the protocol
attack in the client-specified challenge to provide some protection when
‘server schannel = no/auto’ and avoid the false-positive results when
running the proof-of-concept exploit.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 20.04 | noarch | samba | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | ctdb | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | ctdb-dbgsym | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | libnss-winbind | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | libnss-winbind-dbgsym | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | libpam-winbind | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | libpam-winbind-dbgsym | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | libsmbclient | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | libsmbclient-dbgsym | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
Ubuntu | 20.04 | noarch | libsmbclient-dev | < 2:4.11.6+dfsg-0ubuntu1.5 | UNKNOWN |
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
8.7 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.451 Medium
EPSS
Percentile
97.4%