CVE-2015-8467

The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.

CVSS v3 7.5 HIGH
CVSS v2.0 6.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html	Mailing List Third Party Advisory
http://www.debian.org/security/2016/dsa-3433	Third Party Advisory
http://www.securityfocus.com/bid/79735	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1034493	Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2855-1	Third Party Advisory
http://www.ubuntu.com/usn/USN-2855-2	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1290294	Issue Tracking Third Party Advisory
https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d
https://security.gentoo.org/glsa/201612-47	Third Party Advisory
https://www.samba.org/samba/security/CVE-2015-8467.html	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html	Mailing List Third Party Advisory
http://www.debian.org/security/2016/dsa-3433	Third Party Advisory
http://www.securityfocus.com/bid/79735	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1034493	Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2855-1	Third Party Advisory
http://www.ubuntu.com/usn/USN-2855-2	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1290294	Issue Tracking Third Party Advisory
https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d
https://security.gentoo.org/glsa/201612-47	Third Party Advisory
https://www.samba.org/samba/security/CVE-2015-8467.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:7.0:::::::*
	cpe:2.3:o:debian:debian_linux:8.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*

History

21 Nov 2024, 02:38

Type	Values Removed	Values Added
References	~~() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html - Mailing List, Third Party Advisory~~	() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html - Mailing List, Third Party Advisory
References	~~() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html - Mailing List, Third Party Advisory~~	() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html - Mailing List, Third Party Advisory
References	~~() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html - Mailing List, Third Party Advisory~~	() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html - Mailing List, Third Party Advisory
References	~~() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html - Mailing List, Third Party Advisory~~	() http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html - Mailing List, Third Party Advisory
References	~~() http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html - Mailing List, Third Party Advisory~~	() http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html - Mailing List, Third Party Advisory
References	~~() http://www.debian.org/security/2016/dsa-3433 - Third Party Advisory~~	() http://www.debian.org/security/2016/dsa-3433 - Third Party Advisory
References	~~() http://www.securityfocus.com/bid/79735 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/79735 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1034493 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1034493 - Third Party Advisory, VDB Entry
References	~~() http://www.ubuntu.com/usn/USN-2855-1 - Third Party Advisory~~	() http://www.ubuntu.com/usn/USN-2855-1 - Third Party Advisory
References	~~() http://www.ubuntu.com/usn/USN-2855-2 - Third Party Advisory~~	() http://www.ubuntu.com/usn/USN-2855-2 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1290294 - Issue Tracking, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1290294 - Issue Tracking, Third Party Advisory
References	~~() https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d -~~	() https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d -
References	~~() https://security.gentoo.org/glsa/201612-47 - Third Party Advisory~~	() https://security.gentoo.org/glsa/201612-47 - Third Party Advisory
References	~~() https://www.samba.org/samba/security/CVE-2015-8467.html - Vendor Advisory~~	() https://www.samba.org/samba/security/CVE-2015-8467.html - Vendor Advisory

07 Nov 2023, 02:28

Type	Values Removed	Values Added
References	{'url': 'https://git.samba.org/?p=samba.git;a=commit;h=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d', 'name': 'https://git.samba.org/?p=samba.git;a=commit;h=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}	() https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d -

Information

Published : 2015-12-29 22:59

Updated : 2025-04-12 10:46

NVD link : CVE-2015-8467

Mitre link : CVE-2015-8467

CVE.ORG link : CVE-2015-8467

JSON object : View

Products Affected

canonical

ubuntu_linux

debian

debian_linux

samba

samba

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2015-8467", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2015-12-29T22:59:07.547", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2016/dsa-3433", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/79735", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1034493", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/USN-2855-1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/USN-2855-2", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290294", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d", "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201612-47", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.samba.org/samba/security/CVE-2015-8467.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.debian.org/security/2016/dsa-3433", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/79735", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1034493", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/USN-2855-1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/USN-2855-2", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290294", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=b000da128b5fb519d2d3f2e7fd20e4a25b7dae7d", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/201612-47", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.samba.org/samba/security/CVE-2015-8467.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535."}, {"lang": "es", "value": "La funci\u00f3n samldb_check_user_account_control_acl en dsdb/samdb/ldb_modules/samldb.c en Samba 4.x en versiones anteriores a 4.1.22, 4.2.x en versiones anteriores a 4.2.7 y 4.3.x en versiones anteriores a 4.3.3 no comprueba adecuadamente los privilegios administrativos durante la creaci\u00f3n de cuentas de m\u00e1quina, lo que permite a usuarios remotos autenticados eludir las restricciones de acceso destinadas aprovechando la existencia de un dominio tanto con un Samba DC como con un Windows DC, un caso similar a CVE-2015-2535"}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "821BC21F-2B2C-4DE2-8EF6-BBC47DA8433B", "versionEndExcluding": "4.1.22", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEE374EB-8CEF-4E2E-B323-22397E34BD4A", "versionEndExcluding": "4.2.7", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6683E050-3788-41B4-BA5D-32ACDFE79648", "versionEndExcluding": "4.3.3", "versionStartIncluding": "4.3.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "CB66DB75-2B16-4EBF-9B93-CE49D8086E41"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E88A537F-F4D0-46B9-9E37-965233C2A355"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

7.5 /10