CVE-2014-8143

What it actually does

Allows remote authenticated users with delegated account creation rights to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit on Samba AD DC, enabling elevation to domain controller privileges.

Why it matters to the business

Attackers can gain unauthorized control over the Active Directory domain, leading to full network compromise, data theft, and operational disruption; although published over a decade ago with low stable EPSS, unpatched instances remain high-risk in legacy environments.

How an attack unfolds

An attacker with limited delegation rights authenticates to a vulnerable Samba AD DC, creates or modifies an account, sets the server trust account bit, and assumes domain controller identity for further privilege escalation.

How to fix it

Upgrade Samba 4.0.x to 4.0.24 or newer, 4.1.x to 4.1.16 or newer, and 4.2.x to 4.2rc4 or newer; restrict delegation of authority for account creation where feasible.

How to confirm the fix worked

Confirm Samba version exceeds vulnerable ranges listed in the advisory; audit Active Directory for accounts with unexpected UF_SERVER_TRUST_ACCOUNT flags set by delegated users.

Typical attack path

1. Obtain authenticated access with user or computer account delegation rights
2. Leverage LDB interface to modify userAccountControl
3. Set UF_SERVER_TRUST_ACCOUNT bit on a created or existing account
4. Impersonate domain controller to escalate privileges across the domain

How to detect it

Examine Samba and Active Directory event logs for LDB modifications setting the UF_SERVER_TRUST_ACCOUNT bit; search for newly created accounts with server trust flags originating from delegated non-administrative users.

What your security team should do

• Apply the appropriate Samba upgrade immediately on all AD DC instances
• Review and minimize delegation permissions for account creation
• Implement monitoring for userAccountControl modifications
• Test domain controller functionality post-upgrade