SB2012043002 - Permissions, Privileges, and Access Controls in Samba

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012043002

SB2012043002 - Permissions, Privileges, and Access Controls in Samba

Published: April 30, 2012 Updated: July 28, 2020

Security Bulletin ID SB2012043002
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-2111)

The vulnerability allows a remote #AU# to read and manipulate data.

The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.


Remediation

Install update from vendor's website.

References