CVE-2016-2123

 

Published at: - 01-11-2018 02:29

Last modified: - 29-08-2022 10:11

Total changes: - 2

Description

A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.samba.org/samba/security/CVE-2016-2123.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2123
• 1037493-Third Party Advisory, VDB Entry
• 94970-Third Party Advisory, VDB Entry

 

Keywords

NVD

 

CVE-2016-2123

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures