CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2016-2126 – samba: Flaws in Kerberos PAC validation can trigger privilege elevation
https://notcve.org/view.php?id=CVE-2016-2126
Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions. Samba versiones 4.0.0 hasta 4.5.2, es vulnerable a la elevación de privilegios debido al manejo incorrecto de la suma de comprobación PAC (Certificado de Atributo de Privilegio). Un atacante autenticado y remoto puede hacer que el proceso winbindd se bloquee usando un ticket de Kerberos legítimo. • http://rhn.redhat.com/errata/RHSA-2017-0494.html http://rhn.redhat.com/errata/RHSA-2017-0495.html http://rhn.redhat.com/errata/RHSA-2017-0662.html http://rhn.redhat.com/errata/RHSA-2017-0744.html http://www.securityfocus.com/bid/94994 http://www.securitytracker.com/id/1037495 https://access.redhat.com/errata/RHSA-2017:1265 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730 https://www.samba.org/samba/security/CVE-2016-2126.html https://access.redhat • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 94%CPEs: 6EXPL: 0CVE-2016-2123 – Samba NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-2123
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation. • http://www.securityfocus.com/bid/94970 http://www.securitytracker.com/id/1037493 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2123 https://www.samba.org/samba/security/CVE-2016-2123.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •