Vulnetix
Try Vulnetix Request Demo
ALPINE-CVE-2019-14870 PUBLISHED CVSS 5.400000095367432 MEDIUM

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.

Risk Scores

CVSS v3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected Products

VendorProductVersions
Alpine:v3.21heimdal1.2.1-r0, 0, 7.7.0-r8
Alpine:v3.20heimdal0, 1.2.1-r0, 1.2.1-r1
Alpine:v3.18samba4.1.12-r0, 4.1.13-r0, 4.1.14-r0
Alpine:v3.22heimdal7.4.0-r2, 1.4-r10, 1.4-r11
Alpine:v3.15samba3.2.10-r0, 4.8.8-r0, 4.8.7-r0
Alpine:v3.19heimdal1.6_rc2-r5, 1.4-r10, 1.4-r11
Alpine:v3.10samba3.5.6-r0, 3.3.7-r2, 3.3.7-r3
Alpine:v3.16heimdal1.5.2-r7, 1.5.2-r8, 1.5.3-r0
Alpine:v3.21samba3.5.8-r0, 3.5.9-r1, 3.6.1-r0
Alpine:v3.15heimdal7.7.0-r8, 7.7.0-r7, 7.7.0-r6
Alpine:v3.23heimdal1.3.1-r2, 1.3.1-r1, 1.3.1-r0
Alpine:v3.19samba3.6.19-r1, 0, 3.2.10-r0
Alpine:v3.17heimdal7.7.0-r8, 7.7.0-r7, 7.7.0-r6
Alpine:v3.13samba3.5.9-r0, 3.5.8-r0, 3.5.7-r0
Alpine:v3.14heimdal1.4-r0, 1.3.3-r0, 1.3.1-r5
Alpine:v3.20samba4.10.3-r0, 4.10.2-r0, 4.1.9-r0
Alpine:v3.17samba4.6.1-r1, 0, 3.2.10-r0
Alpine:v3.12samba4.1.12-r0, 4.8.8-r0, 4.8.7-r0
Alpine:v3.16samba4.2.3-r1, 4.1.4-r0, 4.1.5-r0
Alpine:v3.14samba4.2.7-r0, 4.2.3-r2, 4.2.3-r1

…and 4 more

Timeline

References

Open in Interactive Console →