CVEvulnerability
CVE-2012-2111
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-04-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.
Affected configurations
• samba samba 3.4.0
• samba samba 3.4.1
• samba samba 3.4.2
• samba samba 3.4.3
• samba samba 3.4.4
• samba samba 3.4.5
• samba samba 3.4.6
• samba samba 3.4.7
• samba samba 3.4.8
• samba samba 3.4.9
• samba samba 3.4.10
• samba samba 3.4.11
• samba samba 3.4.12
• samba samba 3.4.13
• samba samba 3.4.14
• samba samba 3.4.15
• samba samba 3.4.16
• samba samba 3.5.0
• samba samba 3.5.1
• samba samba 3.5.2
• samba samba 3.5.3
• samba samba 3.5.4
• samba samba 3.5.5
• samba samba 3.5.6
• samba samba 3.5.7
• samba samba 3.5.8
• samba samba 3.5.9
• samba samba 3.5.10
• samba samba 3.5.11
• samba samba 3.5.12
• samba samba 3.5.13
• samba samba 3.5.14
• samba samba 3.6.0
• samba samba 3.6.1
• samba samba 3.6.2
• samba samba 3.6.3
• samba samba 3.6.4
Related
Weakness · not in database (1)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079662.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079670.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079677.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00023.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00001.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00003.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=134323086902585&w=2 marc.info
- http://osvdb.org/81648 osvdb.org
- http://rhn.redhat.com/errata/RHSA-2012-0533.html rhn.redhat.com
- http://secunia.com/advisories/48976 secunia.com
- http://secunia.com/advisories/48984 secunia.com
- http://secunia.com/advisories/48996 secunia.com
- http://secunia.com/advisories/48999 secunia.com
- http://secunia.com/advisories/49017 secunia.com
- http://secunia.com/advisories/49030 secunia.com
- http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578 www.collax.com
- http://www.debian.org/security/2012/dsa-2463 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:067 www.mandriva.com
- http://www.samba.org/samba/security/CVE-2012-2111 Patch, Vendor Advisory
- http://www.securitytracker.com/id?1026988 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-1434-1 www.ubuntu.com
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079662.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079670.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079677.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00023.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00001.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00003.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=134323086902585&w=2 marc.info
- http://osvdb.org/81648 osvdb.org
- http://rhn.redhat.com/errata/RHSA-2012-0533.html rhn.redhat.com
- http://secunia.com/advisories/48976 secunia.com
- http://secunia.com/advisories/48984 secunia.com
- http://secunia.com/advisories/48996 secunia.com
- http://secunia.com/advisories/48999 secunia.com
- http://secunia.com/advisories/49017 secunia.com
- http://secunia.com/advisories/49030 secunia.com
- http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578 www.collax.com
- http://www.debian.org/security/2012/dsa-2463 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:067 www.mandriva.com
- http://www.samba.org/samba/security/CVE-2012-2111 Patch, Vendor Advisory
- http://www.securitytracker.com/id?1026988 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-1434-1 www.ubuntu.com