CVE-2014-8143
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory...
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
Exploit likelihood
What each source reports
NVD Score used
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
- Record
CVE-2014-8143- CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
- Record
CVE-2014-8143- Updated
- 2026-11-02
EUVDEUVD-2014-7986 No score
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
- Record
EUVD-2014-7986- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g37q-w784-mfjr No score
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory...
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
- Record
GHSA-g37q-w784-mfjr- Updated
- 2026-11-02
OSV No score
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
- Record
CVE-2014-8143- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-8143 No score
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
- Record
DEBIAN-CVE-2014-8143- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10069-1 No score
ctdb-4.5.0-1.1 on GA media
These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10069-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-8143 No score
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
- Record
UBUNTU-CVE-2014-8143- Updated
- 2026-11-02
OSVUSN-2481-1 No score
samba vulnerability
Andrew Bartlett discovered that Samba incorrectly handled delegation of authority when being used as an Active Directory Domain Controller. An attacker given delegation privileges could use this issue to escalate their privileges further.
- Record
USN-2481-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sambaDebian:12 |
before 2:4.1.17+dfsg-1 | 2:4.1.17+dfsg-1 |
sambaDebian:13 |
before 2:4.1.17+dfsg-1 | 2:4.1.17+dfsg-1 |
sambaDebian:14 |
before 2:4.1.17+dfsg-1 | 2:4.1.17+dfsg-1 |
sambaUbuntu:14.04:LTS |
before 2:4.1.6+dfsg-1ubuntu2.14.04.4, plus listed versions 2:3.6.18-1ubuntu32:4.0.10+dfsg-4ubuntu22:4.0.13+dfsg-1ubuntu12:4.1.3+dfsg-2ubuntu22:4.1.3+dfsg-2ubuntu3 Show 7 moreShow less2:4.1.3+dfsg-2ubuntu42:4.1.3+dfsg-2ubuntu52:4.1.6+dfsg-1ubuntu12:4.1.6+dfsg-1ubuntu22:4.1.6+dfsg-1ubuntu2.14.04.12:4.1.6+dfsg-1ubuntu2.14.04.22:4.1.6+dfsg-1ubuntu2.14.04.3 |
2:4.1.6+dfsg-1ubuntu2.14.04.4 |
sambaopenSUSE:Tumbleweed From an advisory covering 56 CVEs |
before 4.5.0-1.1 | 4.5.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8143 is a high vulnerability (CVSS 8.5) in Samba, published January 16, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.26%, the 91st percentile. Fixed in samba 2:4.1.17+dfsg-1.
References
slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.416326
lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
download.samba.org/pub/samba/patches/security/samba-4.1.15-CVE-2014-8143.patch
securitytracker.com/id/1031615
exchange.xforce.ibmcloud.com/vulnerabilities/100596
Show 67 moreShow less
samba.org/samba/security/CVE-2014-8143
securityfocus.com/bid/72278
secunia.com/advisories/62594
ubuntu.com/usn/USN-2481-1
nvd.nist.gov/vuln/detail/CVE-2014-8143
github.com/advisories/GHSA-g37q-w784-mfjr
security-tracker.debian.org/tracker/CVE-2014-8143
ubuntu.com/security/CVE-2014-8143
cve.org/CVERecord?id=CVE-2014-8143
suse.com/security/cve/CVE-2009-1886