CVE-2016-2123

NameCVE-2016-2123
DescriptionA flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3740-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
samba (PTS)stretch2:4.5.16+dfsg-1+deb9u2fixed
stretch (security)2:4.5.16+dfsg-1+deb9u3fixed
buster2:4.9.5+dfsg-5fixed
buster (security)2:4.9.5+dfsg-5+deb10u1fixed
bullseye, sid2:4.13.3+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sambasourcewheezy(not affected)
sambasourcejessie2:4.2.14+dfsg-0+deb8u2DSA-3740-1
sambasource(unstable)2:4.5.2+dfsg-2

Notes

[wheezy] - samba <not-affected> (Affects only Samba 4.0.0 to 4.5.2)
https://www.samba.org/samba/security/CVE-2016-2123.html

Search for package or bug name: Reporting problems