Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00031.html - | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html - | |
| References | () http://secunia.com/advisories/62594 - | |
| References | () http://www.securityfocus.com/bid/72278 - | |
| References | () http://www.securitytracker.com/id/1031615 - | |
| References | () http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.416326 - | |
| References | () http://www.ubuntu.com/usn/USN-2481-1 - | |
| References | () https://download.samba.org/pub/samba/patches/security/samba-4.0.23-CVE-2014-8143.patch - Patch | |
| References | () https://download.samba.org/pub/samba/patches/security/samba-4.1.15-CVE-2014-8143.patch - Patch | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/100596 - | |
| References | () https://www.samba.org/samba/security/CVE-2014-8143 - Patch, Vendor Advisory |
Information
Published : 2015-01-17 02:59
Updated : 2024-11-21 02:18
NVD link : CVE-2014-8143
Mitre link : CVE-2014-8143
CVE.ORG link : CVE-2014-8143
JSON object : View
Products Affected
samba
- samba
CWE
CWE-264
Permissions, Privileges, and Access Controls