CVE-2012-2111 in Samba Server
Summary
The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Reservation
04/04/2012
Disclosure
04/30/2012
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 5335 | Samba Server Remote Procedural Calls RemoveAccountRights access control | 264 | Proof-of-Concept | Official fix | CVE-2012-2111 |