Unintended Privilege Escalation through Delegated Administrator Rights
CVE-2020-25720
What is CVE-2020-25720?
A vulnerability exists within Samba where a delegated administrator, granted permission to create objects in Active Directory, retains the ability to modify all attributes of those objects, including those that are security-sensitive, despite the object's initial creation. This situation arises from the absence of an Access Control List (ACL) at the time the object is created, designating the administrator as the 'creator owner.' Due to this oversight, the delegated administrator may possess significant rights that can lead to unintended privilege escalation and other security vulnerabilities. It is crucial for organizations using Samba within their Active Directory environments to assess their configurations and secure their access control settings.