Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Debian: Security Advisory for samba (DSA-5015-1)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
The remote host is missing an update for the 'samba' package(s) announced via the DSA-5015-1 advisory.
Insight
Insight
Andrew Bartlett discovered that Samba, a SMB/CIFS file, print, and login server for Unix, may map domain users to local users in an undesired way. This could allow a user in an AD domain to potentially become root on domain members. A new parameter min domain uid (default 1000) has been added to specify the minimum uid allowed when mapping a local account to a domain account. Further details and workarounds can be found in the upstream advisory [link moved to references]
Affected Software
Affected Software
'samba' package(s) on Debian Linux.
Detection Method
Detection Method
Checks if a vulnerable package version is present on the target host.
Solution
Solution
For the oldstable distribution (buster), this problem has been fixed in version 2:4.9.5+dfsg-5+deb10u2. Additionally the update mitigates CVE-2020-25722. Unfortunately the changes required to fix additional CVEs affecting Samba as an AD-compatible domain controller are too invasive to be backported. Thus users using Samba as an AD-compatible domain controller are encouraged to migrate to Debian bullseye. From this point onwards AD domain controller setups are no longer supported in Debian oldstable. We recommend that you upgrade your samba packages.