Samba: ad dc password exposure to privileged users and rodcs

CVE-2023-4154

What is CVE-2023-4154?

A design flaw in Samba's DirSync control implementation grants unauthorized access to sensitive passwords and secret attributes in Active Directory. This flaw specifically compromises Read-Only Domain Controllers (RODCs) and privileged users by allowing them to access all attributes, including secret passwords that should only be restricted. The vulnerability also ignores error conditions, which can lead to accidental overexposure of sensitive data, even under low-privilege scenarios. As a result, RODCs, which are designed to replicate a limited set of passwords, can inadvertently access all domain secrets, including critical account information such as krbtgt.

References