vulnwire
8.1high

CVE-2016-2123

A flaw was found in samba versions 4.0.0 to 4.5.2.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
8.1
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
6.2%
percentile 94%
Public exploits
0
none known

A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.

Exploit prediction (EPSS)

6.23% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • [UNKNOWN] samba

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • samba.org /samba/security/CVE-2016-2123.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/94970 · vdb-entry, x_refsource_BID, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-2123 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1037493 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.