Executive brief
Canonical ADSys, a tool used to manage Ubuntu systems within an Active Directory environment, contains a security flaw in how it handles digital certificates. During the automatic enrollment process, the system uses an insecure connection to download certificate authority (CA) data, allowing an attacker on the same network to intercept the request and insert their own malicious certificate. If exploited, this allows an attacker to bypass encryption (TLS) for the entire system, potentially leading to the theft of sensitive data or persistent monitoring of all network traffic.
Technical details
A vulnerability in Canonical ADSys upstream versions through v0.16.2 arises from the use of plaintext HTTP (http://) instead of HTTPS when requesting CA certificates from an AD CS server via the 'GetCACert' function. This occurs within the vendored Samba client script located at 'gp_cert_auto_enroll_ext.py'. An unauthenticated network attacker in a Man-in-the-Middle position can intercept this request and provide a rogue Root CA certificate. Because ADSys automatically registers this certificate into the local system trust store using 'update-ca-certificates', the attacker can subsequently intercept and decrypt TLS traffic from any application on the host that relies on the OS trust store. The issue is resolved in ADSys version v0.16.3.
Affected products
- Canonical ADSys through v0.16.2
- Canonical Ubuntu 22.04 LTS versions before 0.16.3~22.04.2ubuntu0.22.04.1
- Canonical Ubuntu 24.04 LTS versions before 0.16.3~24.04.2ubuntu0.24.04.1
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory