NVD

Id
47089  
Name
CVE-2012-6150  
Description
The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator"s pam_winbind configuration-file mistake.  
Reject
 
CVSS Version
2  
CVSS Score
3.6  
Severity
Low  
CVSS Base Score
3.6  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:N/AC:H/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2013-12-03  
Modified Date
2017-01-06  
Seq
2012-6150  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
235800 47089 CVE-2012-6150 FEDORA-2014-9132  View
235801 47089 CVE-2012-6150 FEDORA-2014-7672  View
235802 47089 CVE-2012-6150 SUSE-SU-2014:0024  View
235803 47089 CVE-2012-6150 openSUSE-SU-2016:1106  View
235804 47089 CVE-2012-6150 openSUSE-SU-2016:1107  View
235805 47089 CVE-2012-6150 openSUSE-SU-2013:1921  View
235806 47089 CVE-2012-6150 openSUSE-SU-2014:0405  View
235807 47089 CVE-2012-6150 SSRT101413  View
235808 47089 CVE-2012-6150 [oss-security] 20131202 Re: CVE request: samba pam_winbind authentication fails open  View
235809 47089 CVE-2012-6150 RHSA-2014:0330  View
235810 47089 CVE-2012-6150 GLSA-201502-15  View
235811 47089 CVE-2012-6150 MDVSA-2013:299  View
235812 47089 CVE-2012-6150 USN-2054-1  View
235813 47089 CVE-2012-6150 https://bugzilla.redhat.com/show_bug.cgi?id=1036897  View
235814 47089 CVE-2012-6150 https://bugzilla.samba.org/show_bug.cgi?id=10300  View
235815 47089 CVE-2012-6150 [samba-technical] 20120612 winbind pam security problem  View
235816 47089 CVE-2012-6150 [samba-technical] 20131128 fail authentication if user isn"t member of *any* require_membership_of specified groups  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
30373 JVNDB-2012-006081 Samba の nsswitch/pam_winbind.c の winbind_name_list_to_sid_string_list 関数におけるアクセス制限を回避される脆弱性 Samba の nsswitch/pam_winbind.c 内の winbind_name_list_to_sid_string_list 関数は、すべてのユーザによる認証を受け入れることで無効な require_membership_of グループ名を処理するため、アクセス制限を回避される脆弱性が存在します。 CVE-2012-6150 59388 CVE-2012-6150 47089 3.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-006081.html 2012-06-12 2014-03-05 View