samba: privilege elevation

Samba’s Active Directory Domain Controller (AD DC) allows the
administrator to delegate creation of user or computer accounts to
specific users or groups.

Samba’s AD DC did not implement the additional required check on the
UF_SERVER_TRUST_ACCOUNT bit in the userAccountControl attributes.

Most Samba deployments are not of the AD Domain Controller, but are of
the classic domain controller, the file server or print server. Only the
AD DC is affected by this issue.

Additionally, most sites running the AD Domain Controller do not
configure delegation for the creation of user or computer accounts, and
so are not vulnerable to this issue, as no writes are permitted to the
userAccountControl attribute, no matter what the value.