A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
NVD Severity
Other trackers
Mailing lists
GitHub (code, issues), Aports (code, issues)


Type URI

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.19.0 < 4.19.1
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.18.0 < 4.18.8
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.0.0 < 4.17.12

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
samba 3.17-main 4.16.11-r0 Natanael Copa <> possibly vulnerable
samba 3.16-main 4.15.13-r0 Natanael Copa <> possibly vulnerable
samba 3.15-main 4.15.13-r0 Natanael Copa <> possibly vulnerable