===========================================================
== Subject:     Samba AD DC password exposure to privileged
==              users and RODCs
==
== CVE ID#:     
==
== Versions:    All versions since Samba 4.0.0
==
== Summary:     An RODC and a user with the GET_CHANGES
==              right can view all attributes, including
==              secrets and passwords
===========================================================

===========
Description
===========

In normal operation, passwords and (most) secrets are never disclosed
over LDAP in Active Directory.

However, due to a design flaw in Samba's implementation of the DirSync
control, Active Directory accounts authorized to do some replication,
but not to replicate sensitive attributes, can instead replicate
critical domain passwords and secrets.

In a default installation, this means that Administrator accounts -
who can always reset any password - and more concernedly RODC DC
accounts (which should only be permitted to replicate some passwords)
can instead obtain all domain secrets, including the krbtgt.

RODCs are given this permission as part of their installation for DRS
replication.  This vulnerability removes the RODC / DC distinction.

==================
Patch Availability
==================

Patches addressing both these issues have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba $VERSIONS have been issued
as security releases to correct the defect.  Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2)

=================================
Workaround and mitigating factors
=================================

If no RODC accounts are in use in the domain, and DirSync users set
LDAP_DIRSYNC_OBJECT_SECURITY then there is no need to give this right
to any users.  If only privileged accounts have this right, no
vulnerability exists, and if any unprivileged accounts have this
right, the it can be removed.

Since Windows 2003 and in all versions of Samba, it has not been
required to assign accounts this "Get Changes" / GUID_DRS_GET_CHANGES
right to use LDAP DirSync, provided that the
LDAP_DIRSYNC_OBJECT_SECURITY it set in the control.

GUID_DRS_GET_CHANGES / 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 is an
extended right set in the ntSecurityDescriptor on the NC root (the DN
at the top of each partition).  These are for example the domain DN,
configuration DN etc.  The domain DN is the most important.

=======
Credits
=======

Originally reported by Andrew Bartlett of Catalyst and the Samba Team
during routine code review.

Patches provided by Andrew Bartlett of Catalyst and the Samba team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================