CVE-2016-2126: Medium severity samba vulnerability
As per upstream:
A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.
For the remote attack, the memory overwrite kills the main winbindd process and an authenticated attacker can construct this situation by watching for password changes in Samba.
One specific trigger occurs when winbindd changes its machine account password and the client has still a valid Kerberos ticket (that was encrypted with the old password).
Other sources
Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2126?
CVE-2016-2126 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2016-2126?
To fix CVE-2016-2126, update Samba to version 4.5.3 or later, 4.4.8 or later, or 4.3.13 or later depending on your current version.
Who is affected by CVE-2016-2126?
CVE-2016-2126 affects Samba versions from 4.0.0 up to 4.5.2 across various distributions.
What type of attack does CVE-2016-2126 enable?
CVE-2016-2126 enables a remote, authenticated attacker to cause a denial of service by crashing the winbindd process.
Which component of Samba is affected by CVE-2016-2126?
CVE-2016-2126 specifically affects the winbindd process due to improper handling of the PAC checksum.