Published: 10/12/2019 Updated: 07/11/2023

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 5.4 | Impact Score: 2.5 | Exploitability Score: 2.8

VMScore: 571

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

All Samba versions 4.x.x prior to 4.9.17, 4.10.x prior to 4.10.11 and 4.11.x prior to 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba samba
fedoraproject fedora 30
fedoraproject fedora 31
canonical ubuntu linux 18.04
canonical ubuntu linux 19.04
canonical ubuntu linux 14.04
canonical ubuntu linux 19.10
canonical ubuntu linux 16.04
debian debian linux 9.0
debian debian linux 10.0
opensuse leap 15.1

Debian Bug report logs - #1024187 heimdal: CVE-2022-44640 CVE-2022-42898 CVE-2022-3437 CVE-2021-44758 Package: src:heimdal; Maintainer for src:heimdal is Brian May <bam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 15 Nov 2022 21:30:02 UTC Severity: grave Tags: security, upstream Foun ...

Debian Bug report logs - #946786 heimdal: CVE-2019-14870 Package: src:heimdal; Maintainer for src:heimdal is Brian May <bam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 15 Dec 2019 20:36:01 UTC Severity: important Tags: security, upstream Found in version heimdal/750+dfsg-3 Re ...

Several security issues were fixed in Samba ...

CWE-287 https://www.samba.org/samba/security/CVE-2019-14870.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14870 https://security.netapp.com/advisory/ntap-20191210-0002/https://usn.ubuntu.com/4217-1/https://usn.ubuntu.com/4217-2/https://www.synology.com/security/advisory/Synology_SA_19_40 http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html https://security.gentoo.org/glsa/202003-52 https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html https://security.netapp.com/advisory/ntap-20230216-0008/https://security.gentoo.org/glsa/202310-06 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024187 https://usn.ubuntu.com/4217-1/https://nvd.nist.gov

CVE-2019-14870

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect