CVE-2012-2111

Published: 30 April 2012

The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.

Priority

Status

Package	Release	Status
samba Launchpad, Ubuntu, Debian	hardy	Not vulnerable (3.0.28a-1ubuntu4.18)
	lucid	Released (2:3.4.7~dfsg-1ubuntu3.10)
	natty	Released (2:3.5.8~dfsg-1ubuntu2.5)
	oneiric	Released (2:3.5.11~dfsg-1ubuntu2.3)
	precise	Released (2:3.6.3-2ubuntu2.1)
	upstream	Released (3.6.5)

References

https://ubuntu.com/security/notices/USN-1434-1
https://www.cve.org/CVERecord?id=CVE-2012-2111
NVD
Launchpad
Debian

Bugs

https://bugzilla.samba.org/show_bug.cgi?id=8873

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›