CVE-2012-6150 (retired)

Priority
Description
The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c
in Samba through 4.1.2 handles invalid require_membership_of group names by
accepting authentication by any user, which allows remote authenticated
users to bypass intended access restrictions in opportunistic circumstances
by leveraging an administrator's pam_winbind configuration-file mistake.
Assigned-to
mdeslaur
Package
Source: samba (LP Ubuntu Debian)
Upstream:released (3.6.22,4.0.13)
Ubuntu 12.04 ESM (Precise Pangolin):released (2:3.6.3-2ubuntu2.9)
Ubuntu 14.04 LTS (Trusty Tahr):released (2:4.0.13+dfsg-1ubuntu1)
Ubuntu 16.04 LTS (Xenial Xerus):released (2:4.0.13+dfsg-1ubuntu1)
Patches:
Upstream:http://git.samba.org/?p=samba.git;a=commit;h=3b61be8a4b06f929c1bd52c1b8016f9a4fff9be1 (3.6)
Package
Upstream:released (4.0.13,4.1.3)
Ubuntu 12.04 ESM (Precise Pangolin):DNE (precise was needed)
Ubuntu 14.04 LTS (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Patches:
Upstream:http://git.samba.org/?p=samba.git;a=commitdiff;h=f62683956a3b182f6a61cc7a2b4ada2e74cde243
More Information

Updated: 2019-03-26 12:05:20 UTC (commit ccdecfcf0fead22bd291e5f4ea745a46872dcb15)