Published: 29/12/2015 Updated: 07/11/2023

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

CVSS v3 Base Score: 7.5 | Impact Score: 5.9 | Exploitability Score: 1.6

VMScore: 534

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x prior to 4.1.22, 4.2.x prior to 4.2.7, and 4.3.x prior to 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba samba
debian debian linux 8.0
debian debian linux 7.0
canonical ubuntu linux 15.10
canonical ubuntu linux 15.04
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04

Several security issues were fixed in Samba ...

USN-2855-1 introduced a regression in Samba ...

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2015-3223 Thilo Uttendorfer of Linux Information Systems AG discovered that a malicious request can cause the Samba LDAP server to hang, spinning ...

The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldbc in Samba 4x before 4122, 42x before 427, and 43x before 433 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the exist ...

CWE-269 https://www.samba.org/samba/security/CVE-2015-8467.html https://bugzilla.redhat.com/show_bug.cgi?id=1290294 http://www.securityfocus.com/bid/79735 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html http://www.ubuntu.com/usn/USN-2855-2 http://www.ubuntu.com/usn/USN-2855-1 http://www.securitytracker.com/id/1034493 http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html http://www.debian.org/security/2016/dsa-3433 http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html https://security.gentoo.org/glsa/201612-47 https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d https://nvd.nist.gov https://usn.ubuntu.com/2855-1/

CVE-2015-8467

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect