FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

samba -- incorrect permission checks vulnerability

Affected packages
3.4.* < samba34 < 3.4.17
3.5.* < samba35 < 3.5.15
3.6.* < samba36 < 3.6.5

Details

VuXML ID 0fa15e08-92ec-11e1-a94a-00215c6a37bb
Discovery 2012-04-30
Entry 2012-04-30

The Samba project reports:

Samba versions 3.4.x to 3.6.4 inclusive are affected by a vulnerability that allows arbitrary users to modify privileges on a file server.

Security checks were incorrectly applied to the Local Security Authority (LSA) remote proceedure calls (RPC) CreateAccount, OpenAccount, AddAccountRights and RemoveAccountRights allowing any authenticated user to modify the privileges database.

This is a serious error, as it means that authenticated users can connect to the LSA and grant themselves the "take ownership" privilege. This privilege is used by the smbd file server to grant the ability to change ownership of a file or directory which means users could take ownership of files or directories they do not own.

References

CVE Name CVE-2012-2111