CVE-2012-6150: Input Validation
It was reported [1] that Samba's pamwinbind module would fail open (allowing access) when the requiremembershipof option is used as an argument to pamwinbind, and contains a non-existent group as the value. In such a configuration, rather then failing and not permitting authentication which is what would be expected, pamwinbind will allow authentication to proceed.
For instance, if the following is specified and the user is not a member of the group 'Admin', they will not obtain access to the system:
auth sufficient pamwinbind.so usefirstpass requiremembershipof=Admin
On the other hand, if the non-existent group 'AdminOops' is specified, the user is obviously not a member of said group, authentication will be permitted:
auth sufficient pamwinbind.so usefirstpass requiremembershipof=AdminOops
The commit [2] that most likely introduced this flaw indicates that this was introduced October 2009 and another commit [3] looks like the fix, although that is for another bug [4] that's somewhat related to this issue and somewhat not.
[1] https://lists.samba.org/archive/samba-technical/2012-June/084593.html [2] http://git.samba.org/?p=samba.git;a=commit;h=31f1a36901b5b8959dc51401c09c114829b50392 [3] http://git.samba.org/?p=samba.git;a=commitdiff;h=f62683956a3b182f6a61cc7a2b4ada2e74cde243 [4] https://bugzilla.samba.org/showbug.cgi?id=8598
Other sources
The winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c in Samba through 4.1.2 handles invalid requiremembershipof group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pamwinbind configuration-file mistake.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6150?
CVE-2012-6150 has a medium severity rating due to its potential to allow unauthorized authentication.
How do I fix CVE-2012-6150?
To fix CVE-2012-6150, ensure that the require_membership_of option in the pam_winbind module is set to a valid group.
Which software versions are affected by CVE-2012-6150?
CVE-2012-6150 affects Samba versions from 3.3.10 to 3.4.0, 3.4.3 to 3.6.22, and 4.0.0 to 4.0.13, as well as certain versions of Ubuntu Linux.
What are the potential consequences of CVE-2012-6150 if not addressed?
If CVE-2012-6150 is not addressed, it may lead to unauthorized users gaining access to systems by bypassing authentication.
Is CVE-2012-6150 related to a specific configuration?
Yes, CVE-2012-6150 is specifically related to configurations that utilize the pam_winbind module with the require_membership_of option.