CVE-2019-14902

A flaw was found in samba. A newly delegated right, but more importantly the removal of a delegated right, would not be inherited on any DC other than the one where the change was made; the removal would not automatically be taken away on all domain controllers. The highest threat from this vulnerability is to data confidentiality and integrity.

This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux because there is no support for samba as Active Directory Domain Controller.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Use of 'samba-tool drs replicate $DC1 $DC2 $NC --full-sync' will cause all ACLs to be syncronised from DC2 to DC1, for the given NC (naming context), eg:

samba-tool drs replicate my-DC1 my-DC2 DC=samba,DC=example,DC=com --full-sync samba-tool drs replicate my-DC1 my-DC2 CN=Configuration,DC=samba,DC=example,DC=com --full-sync

samba-tool drs replicate my-DC2 my-DC1 DC=samba,DC=example,DC=com --full-sync samba-tool drs replicate my-DC2 my-DC1 CN=Configuration,DC=samba,DC=example,DC=com --full-sync

Internally both in patched and un-patched versions, for every object replicated with a --full-sync, the inheritance will be correctly calculated. This only needs to be done TO each DC, not for each pair-wise pair.