CVE-2012-6150
03.12.2013, 19:55
The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.Enginsight
| Vendor | Product | Version |
|---|---|---|
| samba | samba | 3.3.10 ≤ 𝑥 < 3.4.0 |
| samba | samba | 3.4.3 ≤ 𝑥 < 3.6.22 |
| samba | samba | 4.0.0 ≤ 𝑥 < 4.0.13 |
| samba | samba | 4.1.0 ≤ 𝑥 < 4.1.3 |
| canonical | ubuntu_linux | 10.04 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 12.10 |
| canonical | ubuntu_linux | 13.04 |
| canonical | ubuntu_linux | 13.10 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| samba |
| ||||||||||||||||||||||||
| samba4 |
|
Common Weakness Enumeration
References