{"id":"CVE-2023-4154","aliases":["ALPINE-CVE-2023-4154","AZL-31955","AZL-37026","DEBIAN-CVE-2023-4154","DSA-5525-1","EUVD-2023-54034","GHSA-v5f6-rpxq-xvg8","SUSE-SU-2023:4046-1","SUSE-SU-2023:4059-1","SUSE-SU-2023:4096-1","UBUNTU-CVE-2023-4154","USN-6425-1","openSUSE-SU-2024:13332-1"],"status":"published","title":"Samba: ad dc password exposure to privileged users and rodcs","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01397,"percentile":0.72615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-787"],"published":"2023-10-10T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"samba","fixed_in":["4.18.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"samba","fixed_in":["4.18.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"samba","fixed_in":["4.18.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"samba","fixed_in":["4.18.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"samba","fixed_in":["4.18.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"samba","fixed_in":["4.18.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"samba","fixed_in":["4.18.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.17.12+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.19.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.19.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"samba","fixed_in":["2:4.15.13+dfsg-0ubuntu0.20.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"samba","fixed_in":["2:4.15.13+dfsg-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"samba","fixed_in":["2:4.18.6+dfsg-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.18.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.18.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.18.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.18.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.18.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.18.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.18.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.12.5-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.18.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.17.12+dfsg-0+deb12u1"}]}],"versions":["2:4.17.10+dfsg-0+deb12u1","2:4.17.10+dfsg-0+deb12u1~bpo11+1","2:4.17.11+dfsg-0+deb12u1","2:4.17.12+dfsg-0+deb12u1~bpo11+1","2:4.17.8+dfsg-2","2:4.17.8+dfsg-2.1","2:4.17.9+dfsg-0+deb12u1","2:4.17.9+dfsg-0+deb12u2","2:4.17.9+dfsg-0+deb12u3","2:4.17.9+dfsg-0+deb12u3~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.19.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.19.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.17.12+dfsg-0+deb12u1"}]}],"versions":["2:4.17.10+dfsg-0+deb12u1","2:4.17.10+dfsg-0+deb12u1~bpo11+1","2:4.17.11+dfsg-0+deb12u1","2:4.17.12+dfsg-0+deb12u1~bpo11+1","2:4.17.8+dfsg-2","2:4.17.8+dfsg-2.1","2:4.17.9+dfsg-0+deb12u1","2:4.17.9+dfsg-0+deb12u2","2:4.17.9+dfsg-0+deb12u3","2:4.17.9+dfsg-0+deb12u3~bpo11+1"],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.9+git.421.abde31ca5c2-150500.3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.9+git.421.abde31ca5c2-150500.3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.9+git.421.abde31ca5c2-150500.3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.9+git.421.abde31ca5c2-150500.3.11.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150400.3.31.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150400.3.31.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150400.3.31.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150400.3.31.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150400.3.31.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.691.3d3cea0641-150300.3.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3","2:4.1.6+dfsg-1ubuntu2.14.04.4","2:4.1.6+dfsg-1ubuntu2.14.04.5","2:4.1.6+dfsg-1ubuntu2.14.04.7","2:4.1.6+dfsg-1ubuntu2.14.04.8","2:4.1.6+dfsg-1ubuntu2.14.04.9","2:4.1.6+dfsg-1ubuntu2.14.04.11","2:4.1.6+dfsg-1ubuntu2.14.04.12","2:4.1.6+dfsg-1ubuntu2.14.04.13","2:4.3.8+dfsg-0ubuntu0.14.04.2","2:4.3.9+dfsg-0ubuntu0.14.04.1","2:4.3.9+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.1","2:4.3.11+dfsg-0ubuntu0.14.04.2","2:4.3.11+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.4","2:4.3.11+dfsg-0ubuntu0.14.04.6","2:4.3.11+dfsg-0ubuntu0.14.04.7","2:4.3.11+dfsg-0ubuntu0.14.04.8","2:4.3.11+dfsg-0ubuntu0.14.04.9","2:4.3.11+dfsg-0ubuntu0.14.04.10","2:4.3.11+dfsg-0ubuntu0.14.04.11","2:4.3.11+dfsg-0ubuntu0.14.04.12","2:4.3.11+dfsg-0ubuntu0.14.04.13","2:4.3.11+dfsg-0ubuntu0.14.04.14","2:4.3.11+dfsg-0ubuntu0.14.04.16","2:4.3.11+dfsg-0ubuntu0.14.04.17","2:4.3.11+dfsg-0ubuntu0.14.04.19","2:4.3.11+dfsg-0ubuntu0.14.04.20","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm1","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm2","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm3","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm6","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm7","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm8","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm9","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm11","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm12","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm14","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13","2:4.3.11+dfsg-0ubuntu0.16.04.15","2:4.3.11+dfsg-0ubuntu0.16.04.16","2:4.3.11+dfsg-0ubuntu0.16.04.17","2:4.3.11+dfsg-0ubuntu0.16.04.18","2:4.3.11+dfsg-0ubuntu0.16.04.19","2:4.3.11+dfsg-0ubuntu0.16.04.20","2:4.3.11+dfsg-0ubuntu0.16.04.21","2:4.3.11+dfsg-0ubuntu0.16.04.23","2:4.3.11+dfsg-0ubuntu0.16.04.24","2:4.3.11+dfsg-0ubuntu0.16.04.25","2:4.3.11+dfsg-0ubuntu0.16.04.26","2:4.3.11+dfsg-0ubuntu0.16.04.27","2:4.3.11+dfsg-0ubuntu0.16.04.28","2:4.3.11+dfsg-0ubuntu0.16.04.29","2:4.3.11+dfsg-0ubuntu0.16.04.30","2:4.3.11+dfsg-0ubuntu0.16.04.31","2:4.3.11+dfsg-0ubuntu0.16.04.32","2:4.3.11+dfsg-0ubuntu0.16.04.34","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm1","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm3","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2","2:4.7.6+dfsg~ubuntu-0ubuntu2.2","2:4.7.6+dfsg~ubuntu-0ubuntu2.4","2:4.7.6+dfsg~ubuntu-0ubuntu2.5","2:4.7.6+dfsg~ubuntu-0ubuntu2.6","2:4.7.6+dfsg~ubuntu-0ubuntu2.7","2:4.7.6+dfsg~ubuntu-0ubuntu2.9","2:4.7.6+dfsg~ubuntu-0ubuntu2.10","2:4.7.6+dfsg~ubuntu-0ubuntu2.11","2:4.7.6+dfsg~ubuntu-0ubuntu2.13","2:4.7.6+dfsg~ubuntu-0ubuntu2.14","2:4.7.6+dfsg~ubuntu-0ubuntu2.15","2:4.7.6+dfsg~ubuntu-0ubuntu2.16","2:4.7.6+dfsg~ubuntu-0ubuntu2.17","2:4.7.6+dfsg~ubuntu-0ubuntu2.18","2:4.7.6+dfsg~ubuntu-0ubuntu2.19","2:4.7.6+dfsg~ubuntu-0ubuntu2.20","2:4.7.6+dfsg~ubuntu-0ubuntu2.21","2:4.7.6+dfsg~ubuntu-0ubuntu2.23","2:4.7.6+dfsg~ubuntu-0ubuntu2.24","2:4.7.6+dfsg~ubuntu-0ubuntu2.26","2:4.7.6+dfsg~ubuntu-0ubuntu2.27","2:4.7.6+dfsg~ubuntu-0ubuntu2.28","2:4.7.6+dfsg~ubuntu-0ubuntu2.29","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm2","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.6"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10","2:4.13.14+dfsg-0ubuntu0.20.04.1","2:4.13.14+dfsg-0ubuntu0.20.04.2","2:4.13.14+dfsg-0ubuntu0.20.04.3","2:4.13.14+dfsg-0ubuntu0.20.04.4","2:4.13.17~dfsg-0ubuntu0.21.04.1","2:4.13.17~dfsg-0ubuntu0.21.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.1","2:4.13.17~dfsg-0ubuntu1.20.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.4","2:4.13.17~dfsg-0ubuntu1.20.04.5","2:4.15.13+dfsg-0ubuntu0.20.04.1","2:4.15.13+dfsg-0ubuntu0.20.04.2","2:4.15.13+dfsg-0ubuntu0.20.04.3","2:4.15.13+dfsg-0ubuntu0.20.04.4","2:4.15.13+dfsg-0ubuntu0.20.04.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu1.5"}]}],"versions":["2:4.13.5+dfsg-2ubuntu2","2:4.13.5+dfsg-2ubuntu3","2:4.13.14+dfsg-0ubuntu1","2:4.13.14+dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu1","2:4.15.5~dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu4","2:4.15.5~dfsg-0ubuntu5","2:4.15.5~dfsg-0ubuntu5.1","2:4.15.9+dfsg-0ubuntu0.2","2:4.15.9+dfsg-0ubuntu0.3","2:4.15.13+dfsg-0ubuntu1","2:4.15.13+dfsg-0ubuntu1.1","2:4.15.13+dfsg-0ubuntu1.2","2:4.15.13+dfsg-0ubuntu1.3","2:4.15.13+dfsg-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.18.6+dfsg-1ubuntu2.1"}]}],"versions":["2:4.18.6+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu0.20.04.6"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10","2:4.13.14+dfsg-0ubuntu0.20.04.1","2:4.13.14+dfsg-0ubuntu0.20.04.2","2:4.13.14+dfsg-0ubuntu0.20.04.3","2:4.13.14+dfsg-0ubuntu0.20.04.4","2:4.13.17~dfsg-0ubuntu0.21.04.1","2:4.13.17~dfsg-0ubuntu0.21.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.1","2:4.13.17~dfsg-0ubuntu1.20.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.4","2:4.13.17~dfsg-0ubuntu1.20.04.5","2:4.15.13+dfsg-0ubuntu0.20.04.1","2:4.15.13+dfsg-0ubuntu0.20.04.2","2:4.15.13+dfsg-0ubuntu0.20.04.3","2:4.15.13+dfsg-0ubuntu0.20.04.4","2:4.15.13+dfsg-0ubuntu0.20.04.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu1.5"}]}],"versions":["2:4.13.5+dfsg-2ubuntu2","2:4.13.5+dfsg-2ubuntu3","2:4.13.14+dfsg-0ubuntu1","2:4.13.14+dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu1","2:4.15.5~dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu4","2:4.15.5~dfsg-0ubuntu5","2:4.15.5~dfsg-0ubuntu5.1","2:4.15.9+dfsg-0ubuntu0.2","2:4.15.9+dfsg-0ubuntu0.3","2:4.15.13+dfsg-0ubuntu1","2:4.15.13+dfsg-0ubuntu1.1","2:4.15.13+dfsg-0ubuntu1.2","2:4.15.13+dfsg-0ubuntu1.3","2:4.15.13+dfsg-0ubuntu1.4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.1+git.312.c912b3d2ef6-1.1"}]}],"bundled":5}],"products":[{"vendor":"fedora","product":"fedora"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat storage 3"},{"vendor":"samba","product":"samba"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-4154","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241883","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","report"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=15424","tags":["x_transferred","Issue Tracking","Patch","report"]},{"url":"https://security.netapp.com/advisory/ntap-20231124-0002/","tags":["x_transferred","advisory"]},{"url":"https://www.samba.org/samba/security/CVE-2023-4154.html","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4154","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v5f6-rpxq-xvg8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-4154","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://packages.fedoraproject.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4154.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-4154","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234046-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215904","tags":["report"]},{"url":"https://bugzilla.suse.com/1215905","tags":["report"]},{"url":"https://bugzilla.suse.com/1215906","tags":["report"]},{"url":"https://bugzilla.suse.com/1215907","tags":["report"]},{"url":"https://bugzilla.suse.com/1215908","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42670","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234059-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213940","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234096-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-4154","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6425-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6425-3","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42670","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4154","title":"Samba: ad dc password exposure to privileged users and rodcs","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T19:14:28.305Z","modified":"2024-08-02T07:17:12.144Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:30.474787Z"}],"euvd":[{"id":"EUVD-2023-54034","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T19:14:28Z","modified":"2024-08-02T07:17:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:12.64889Z"}],"ghsa":[{"id":"GHSA-v5f6-rpxq-xvg8","title":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and...","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T21:30:24Z","modified":"2023-11-24T09:30:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200","CWE-787"],"updated_at":"2026-11-02T14:55:05.78804Z"}],"nvd":[{"id":"CVE-2023-4154","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T20:15:08.683Z","modified":"2026-06-17T06:37:11.603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"ALPINE-CVE-2023-4154","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T20:15:08.683Z","modified":"2026-10-26T17:17:58.63869685Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-31955","title":"CVE-2023-4154 affecting package samba 4.12.5-7","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T20:15:08Z","modified":"2026-04-21T04:26:35.917432Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-37026","title":"CVE-2023-4154 affecting package samba 4.18.3-2","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T20:15:08Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"CVE-2023-4154","title":"Samba: ad dc password exposure to privileged users and rodcs","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T19:14:28.305Z","modified":"2026-10-28T02:31:12.815739983Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-4154","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-11-07T20:15:08.683Z","modified":"2026-10-26T18:02:32.749573907Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"UBUNTU-CVE-2023-4154","description":"A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.","status":"published","published":"2023-10-10T00:00:00Z","modified":"2026-04-22T14:11:52.64333Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"DSA-5525-1","title":"samba - security update","status":"published","published":"2023-10-11T00:00:00Z","modified":"2026-03-09T02:09:24.557127Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13332-1","title":"ctdb-4.19.1+git.312.c912b3d2ef6-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.19.1+git.312.c912b3d2ef6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:15:07.828921Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4046-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. (bsc#1215904)\n- CVE-2023-42669: Fixed a bug in 'rpcecho' development server which allows Denial of Service via sleep() call on AD DC. (bsc#1215905)\n- CVE-2023-42670: Fixed the procedure number which was out of range when starting Active Directory Users and Computers. (bsc#1215906)\n- CVE-2023-3961: Fixed an unsanitized client pipe name passed to local_np_connect(). (bsc#1215907)\n- CVE-2023-4154: Fixed a bug in dirsync which allows SYSTEM access with only 'GUID_DRS_GET_CHANGES' right. (bsc#1215908)\n","status":"published","published":"2023-10-11T07:26:18Z","modified":"2025-05-02T04:35:17.214193Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:4059-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. (bsc#1215904)\n- CVE-2023-42669: Fixed a bug in 'rpcecho' development server which allows Denial of Service via sleep() call on AD DC. (bso#1215905)\n- CVE-2023-4154: Fixed a bug in dirsync which allows SYSTEM access with only 'GUID_DRS_GET_CHANGES' right. (bsc#1215908)\n","status":"published","published":"2023-10-12T08:03:22Z","modified":"2026-02-04T03:31:13.068791Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:4096-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. (bsc#1215904)\n- CVE-2023-42669: Fixed a bug in 'rpcecho' development server which allows Denial of Service via sleep() call on AD DC. (bso#1215905)\n- CVE-2023-4154: Fixed a bug in dirsync which allows SYSTEM access with only 'GUID_DRS_GET_CHANGES' right. (bsc#1215908)\n","status":"published","published":"2023-10-17T13:04:24Z","modified":"2026-02-04T02:31:28.027872Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6425-1","title":"samba vulnerabilities","description":"Sri Nagasubramanian discovered that the Samba acl_xattr VFS module\nincorrectly handled read-only files. When Samba is configured to ignore\nsystem ACLs, a remote attacker could possibly use this issue to truncate\nread-only files. (CVE-2023-4091)\n\nAndrew Bartlett discovered that Samba incorrectly handled the DirSync\ncontrol. A remote attacker with an RODC DC account could possibly use this\nissue to obtain all domain secrets. (CVE-2023-4154)\n\nAndrew Bartlett discovered that Samba incorrectly handled the rpcecho\ndevelopment server. A remote attacker could possibly use this issue to\ncause Samba to stop responding, resulting in a denial of service.\n(CVE-2023-42669)\n\nKirin van der Veer discovered that Samba incorrectly handled certain RPC\nservice listeners. A remote attacker could possibly use this issue to cause\nSamba to start multiple incompatible RPC listeners, resulting in a denial\nof service. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.\n(CVE-2023-42670)\n","status":"published","published":"2023-10-10T15:01:00Z","modified":"2026-04-27T17:02:13.310126653Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}