CVE-2016-2123
published 2018-11-01CVE-2016-2123: A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled…
PriorityP351high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
6.23%
92.8th percentile
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.5.2+dfsg-2 (bookworm) | samba 2:4.5.2+dfsg-2 (bookworm) |
| samba | samba | >= 0 < 2:4.5.2+dfsg-2 | 2:4.5.2+dfsg-2 |
| samba | samba | >= 0 < 2:4.5.2+dfsg-2 | 2:4.5.2+dfsg-2 |
| samba | samba | >= 0 < 2:4.5.2+dfsg-2 | 2:4.5.2+dfsg-2 |
| samba | samba | >= 0 < 2:4.5.2+dfsg-2 | 2:4.5.2+dfsg-2 |
| samba | samba | >= 0 < 2:4.3.11+dfsg-0ubuntu0.14.04.4 | 2:4.3.11+dfsg-0ubuntu0.14.04.4 |
| samba | samba | >= 0 < 2:4.3.11+dfsg-0ubuntu0.16.04.3 | 2:4.3.11+dfsg-0ubuntu0.16.04.3 |
| samba | samba | 4.0.0 – 4.0.26 | — |
| samba | samba | 4.1.0 – 4.1.23 | — |
| samba | samba | 4.2.0 – 4.2.14 | — |
| samba | samba | >= 4.3.0 < 4.3.13 | 4.3.13 |
| samba | samba | >= 4.4.0 < 4.4.8 | 4.4.8 |
| samba | samba | >= 4.5.0 < 4.5.3 | 4.5.3 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
samba: NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability (ZDI-CAN-3995)
vendor_redhat·2016-12-19·CVSS 8.8
CVE-2016-2123 [HIGH] CWE-122 samba: NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability (ZDI-CAN-3995)
samba: NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability (ZDI-CAN-3995)
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
Statement: Red Hat Enterprise Linux 5, 6 and 7 are not affected by this flaw because we do not ship Samba with the AD DNS Server, which is the vulnerable component.
Package: samba (Re
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2016-12-19·CVSS 8.8
CVE-2016-2123 [HIGH] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
Frederic Besler and others discovered that the ndr_pull_dnsp_nam
function in Samba contained an integer overflow. An authenticated
attacker could use this to gain administrative privileges. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10.
(CVE-2016-2123)
Simo Sorce discovered that that Samba clients always requested
a forwardable ticket when using Kerberos authentication. An
attacker could use this to impersonate an authenticated user or
service. (CVE-2016-2125)
Volker Lendecke discovered that Kerberos PAC validation implementation
in Samba contained multiple vulnerabilities. An authenticated attacker
could use this to cause a denial of service or gain administrative
privile
Debian
CVE-2016-2123: samba - A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dn...
vendor_debian·2016·CVSS 8.8
CVE-2016-2123 [HIGH] CVE-2016-2123: samba - A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dn...
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
Scope: local
bookworm: resolved (fixed in 2:4.5.2+dfsg-2)
bullseye: resolved (fixed in 2:4.5.2+dfsg-2)
forky: resolved (fixed in 2:4.5.2+dfsg-2)
sid: resolved (fixed in 2:4.5.2+dfsg-2)
trixie: resolved (fixed in 2:4.5.2+dfsg-2)
GHSA
GHSA-m2v2-w4f9-rmq6: A flaw was found in samba versions 4
ghsa_unreviewed·2022-05-13
CVE-2016-2123 [HIGH] CWE-119 GHSA-m2v2-w4f9-rmq6: A flaw was found in samba versions 4
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
OSV
CVE-2016-2123: A flaw was found in samba versions 4
osv·2018-11-01·CVSS 8.8
CVE-2016-2123 [HIGH] CVE-2016-2123: A flaw was found in samba versions 4
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
OSV
samba vulnerabilities
osv·2016-12-19·CVSS 8.8
CVE-2016-2123 [HIGH] samba vulnerabilities
samba vulnerabilities
Frederic Besler and others discovered that the ndr_pull_dnsp_nam
function in Samba contained an integer overflow. An authenticated
attacker could use this to gain administrative privileges. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10.
(CVE-2016-2123)
Simo Sorce discovered that that Samba clients always requested
a forwardable ticket when using Kerberos authentication. An
attacker could use this to impersonate an authenticated user or
service. (CVE-2016-2125)
Volker Lendecke discovered that Kerberos PAC validation implementation
in Samba contained multiple vulnerabilities. An authenticated attacker
could use this to cause a denial of service or gain administrative
privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
L
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-2123 samba: NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability (ZDI-CAN-3995)
bugzilla·2016-11-08·CVSS 8.8
CVE-2016-2123 [HIGH] CVE-2016-2123 samba: NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability (ZDI-CAN-3995)
CVE-2016-2123 samba: NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability (ZDI-CAN-3995)
As per upstream:
The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption.
By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
Discussion:
Statement:
Red Hat Enterprise Linux 5, 6 and 7 are not affected by this flaw because we do not ship Samba with the AD DNS Server, which is the vulnerable component.
---
External Referenc
arXiv
Analyzing the Perceived Severity of Cybersecurity Threats Reported on Social Media
arxiv_fulltext·2019-05-03
Analyzing the Perceived Severity of Cybersecurity Threats Reported on Social Media
## Abstract
Breaking cybersecurity events are shared across a range of websites, including security blogs (FireEye, Kaspersky, etc.), in addition to social media platforms such as Facebook and Twitter. In this paper, we investigate methods to analyze the severity of cybersecurity threats based on the language that is used to describe them online. A corpus of 6,000 tweets describing software vulnerabilities is annotated with authors' opinions toward their severity. We show that our corpus supports the development of automatic classifiers with high precision for this task. Furthermore, we demonstrate the value of analyzing users' opinions about the severity of threats reported online as an early indicator of important software vulnerabilities. We present a simple, yet effective method for l
http://www.securityfocus.com/bid/94970http://www.securitytracker.com/id/1037493https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2123https://www.samba.org/samba/security/CVE-2016-2123.htmlhttp://www.securityfocus.com/bid/94970http://www.securitytracker.com/id/1037493https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2123https://www.samba.org/samba/security/CVE-2016-2123.html
2018-11-01
Published