CVE-2012-6150
LOW severity · CVSS 3.6 · Improper input validation
3.6CVSS LOW
Summary
The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.
Impact & exploitability
Attack vectorNetwork
Attack complexityHigh
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impactNone
Exploit probability (EPSS)4%
AV:N/AC:H/Au:S/C:P/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.htmlAdvisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00002.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlAdvisory
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.htmlAdvisory
- http://lists.opensuse.org/opensuse-updates/2014-03/msg00063.htmlAdvisory
- http://marc.info/?l=bugtraq&m=141660010015249&w=2Advisory