Critical Elevation of Privilege Vulnerability in Samba Affects Multiple Alpine Versions
Summary
ALPINE-CVE-2020-1472: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). Affects samba versions < 4.10.18-r0. Fixed in 4.10.18-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Samba is an open-source software suite that enables file and print services to SMB/CIFS clients. It allows for seamless interoperability between Linux/Unix servers and Windows-based clients. This vulnerability affects various versions of Samba in Alpine Linux, specifically versions 3.10 through 3.22, which could allow unauthorized access to domain administrator privileges through a compromised Netlogon secure channel connection.
Vulnerability Detail
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller using the Netlogon Remote Protocol (MS-NRPC). If exploited, an unauthenticated attacker could run a specially crafted application on a device within the network, potentially gaining domain administrator access. This vulnerability is critical as it allows attackers to manipulate network resources and gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
4.10.18-r0
This is the first release that contains the fix.
sudo apk add --upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the Netlogon secure channel or implementing network segmentation to limit exposure to potential attackers until the package can be updated.
Conclusion
The CVE-2020-1472 vulnerability poses a significant risk to systems using Samba in Alpine Linux. It is crucial to update the affected packages to their patched versions to mitigate the risk of unauthorized access. Implementing workarounds can provide temporary relief, but timely updates are essential for long-term security.
See every vulnerability recorded for samba →
FAQ
CVE-2020-1472 is a critical vulnerability in the Netlogon Remote Protocol that allows attackers to gain unauthorized access to domain administrator privileges.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Alpine versions 3.10 through 3.22 are affected by this vulnerability in the Samba package.
Exploiting this vulnerability could allow an attacker to run malicious applications on the network, potentially leading to unauthorized access to sensitive data and resources.
You can register for security notifications from Microsoft to receive alerts about updates and changes related to CVE-2020-1472.
References
Related vulnerabilities
Recent vulnerabilities recorded for samba.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
