{"id":"CVE-2014-8143","aliases":["DEBIAN-CVE-2014-8143","EUVD-2014-7986","GHSA-g37q-w784-mfjr","UBUNTU-CVE-2014-8143","USN-2481-1","openSUSE-SU-2024:10069-1"],"status":"published","title":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory...","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","severity":{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04264,"percentile":0.91136,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-01-16T00:00:00Z","modified":"2026-10-23T15:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.1.17+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.1.17+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.1.17+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"samba","fixed_in":["2:4.1.6+dfsg-1ubuntu2.14.04.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.17+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.17+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.17+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.6+dfsg-1ubuntu2.14.04.4"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.6+dfsg-1ubuntu2.14.04.4"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.1"}]}],"bundled":56}],"products":[{"vendor":"samba","product":"samba"}],"references":[{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2015\u0026m=slackware-security.416326","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://download.samba.org/pub/samba/patches/security/samba-4.1.15-CVE-2014-8143.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"http://www.securitytracker.com/id/1031615","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100596","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://download.samba.org/pub/samba/patches/security/samba-4.0.23-CVE-2014-8143.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"https://www.samba.org/samba/security/CVE-2014-8143","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/72278","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/62594","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2481-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8143"},{"url":"https://github.com/advisories/GHSA-g37q-w784-mfjr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8143","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-8143","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2481-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8143","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2119","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8143","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","status":"published","published":"2015-01-17T02:00:00Z","modified":"2024-08-06T13:10:51.032Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-7986","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","status":"published","published":"2015-01-17T02:00:00Z","modified":"2024-08-06T13:10:51Z","updated_at":"2026-11-03T01:56:52.951821Z"}],"ghsa":[{"id":"GHSA-g37q-w784-mfjr","title":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory...","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","status":"published","published":"2022-05-17T01:13:39Z","modified":"2023-02-03T05:03:25Z","updated_at":"2026-11-02T14:53:21.228019Z"}],"nvd":[{"id":"CVE-2014-8143","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","status":"published","published":"2015-01-17T02:59:03.617Z","modified":"2026-06-17T00:16:22.123Z","cvss":[{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:58.030217Z"}],"osv":[{"id":"CVE-2014-8143","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","status":"published","published":"2015-01-17T02:59:03Z","modified":"2026-04-10T03:44:04.800928Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-8143","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","status":"published","published":"2015-01-17T02:59:03.617Z","modified":"2026-10-23T15:47:32.898416992Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"openSUSE-SU-2024:10069-1","title":"ctdb-4.5.0-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:47:57.807269Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-8143","description":"Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.","status":"published","published":"2015-01-16T00:00:00Z","modified":"2026-04-22T09:51:59.796273Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2481-1","title":"samba vulnerability","description":"Andrew Bartlett discovered that Samba incorrectly handled delegation of\nauthority when being used as an Active Directory Domain Controller. An\nattacker given delegation privileges could use this issue to escalate their\nprivileges further.\n","status":"published","published":"2015-01-22T14:38:56Z","modified":"2026-04-22T09:07:48.357592Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}