Test ID:	1.3.6.1.4.1.25623.1.0.113287
Category:	Privilege escalation
Title:	Samba >= 4.0.0, <= 4.5.2 Multiple Privilege Escalation Vulnerabilities
Summary:	Samba is prone to multiple privilege escalation vulnerabilities.
Description:	Summary: Samba is prone to multiple privilege escalation vulnerabilities. Vulnerability Insight: - CVE-2016-2126: Samba is prone to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to creash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions. - CVE-2016-2123: The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation. Vulnerability Impact: Successful exploitation would allow an authenticated attacker to gain additional access rights. Affected Software/OS: Samba versions 4.0.0 through 4.3.12, 4.4.0 through 4.4.7 and 4.5.0 through 4.5.2. Solution: Update to version 4.3.13, 4.4.8 or 4.5.3 respectively. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-2126 BugTraq ID: 94994 http://www.securityfocus.com/bid/94994 RedHat Security Advisories: RHSA-2017:0494 http://rhn.redhat.com/errata/RHSA-2017-0494.html RedHat Security Advisories: RHSA-2017:0495 http://rhn.redhat.com/errata/RHSA-2017-0495.html RedHat Security Advisories: RHSA-2017:0662 http://rhn.redhat.com/errata/RHSA-2017-0662.html RedHat Security Advisories: RHSA-2017:0744 http://rhn.redhat.com/errata/RHSA-2017-0744.html RedHat Security Advisories: RHSA-2017:1265 https://access.redhat.com/errata/RHSA-2017:1265 http://www.securitytracker.com/id/1037495 Common Vulnerability Exposure (CVE) ID: CVE-2016-2123 1037493 http://www.securitytracker.com/id/1037493 94970 http://www.securityfocus.com/bid/94970 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2123 https://www.samba.org/samba/security/CVE-2016-2123.html
Copyright	Copyright (C) 2018 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.