CVE-2012-6150

Summary

CVE	CVE-2012-6150
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2013-12-03 19:55:03 UTC
Updated	2026-04-29 01:13:23 UTC
Description	The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.

Risk And Classification

Primary CVSS: v2.0 3.6 from [email protected]

AV:N/AC:H/Au:S/C:P/I:P/A:N

Problem Types: CWE-20 | n/a

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

High

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

None

AV:N/AC:H/Au:S/C:P/I:P/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Samba	Samba	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
Samba: Multiple vulnerabilities (GLSA 201502-15) — Gentoo security	af854a3a-2127-422b-91ae-364da2661108	security.gentoo.org	Third Party Advisory
Support / Security / Advisories / / MDVSA-2013:299 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com	Third Party Advisory
1036897 – (CVE-2012-6150) CVE-2012-6150 samba: pam_winbind fails open when non-existent group specified to require_membership_of	af854a3a-2127-422b-91ae-364da2661108	bugzilla.redhat.com	Issue Tracking, Third Party Advisory
openSUSE-SU-2014:0405-1: moderate: samba: security and bugfix update	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org	Mailing List, Third Party Advisory
Red Hat Customer Portal	af854a3a-2127-422b-91ae-364da2661108	rhn.redhat.com	Third Party Advisory
[security-announce] SUSE-SU-2014:0024-1: important: Security update for	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org	Mailing List, Third Party Advisory
winbind pam security problem	af854a3a-2127-422b-91ae-364da2661108	lists.samba.org	Exploit, Vendor Advisory
fail authentication if user isn't member of any require_membership_of specified groups	af854a3a-2127-422b-91ae-364da2661108	lists.samba.org	Exploit, Vendor Advisory
openSUSE-SU-2013:1921-1: moderate: update for samba	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org	Mailing List, Third Party Advisory
Bug 10300 – fail authentication if user isn't member of any require_membership_of specified groups	af854a3a-2127-422b-91ae-364da2661108	bugzilla.samba.org	Issue Tracking, Patch, Third Party Advisory
oss-security - Re: CVE request: samba pam_winbind authentication fails open	af854a3a-2127-422b-91ae-364da2661108	openwall.com	Mailing List, Third Party Advisory
[security-announce] openSUSE-SU-2016:1107-1: important: Security update	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org	Mailing List, Third Party Advisory
[SECURITY] Fedora 19 Update: samba-4.0.21-1.fc19	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List, Third Party Advisory
[SECURITY] Fedora 20 Update: samba-4.1.9-3.fc20	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List, Third Party Advisory
[security-announce] openSUSE-SU-2016:1106-1: important: Security update	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org	Mailing List, Third Party Advisory
USN-2054-1: Samba vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com	Third Party Advisory
'[security bulletin] HPSBUX03087 SSRT101413 rev.2 - HP-UX CIFS Server (Samba), Remote Denial of Servi' - MARC	af854a3a-2127-422b-91ae-364da2661108	marc.info	Mailing List, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.