High severity · published Nov 1, 2018
CVE-2016-2123
A flaw was found in samba versions 4.0.0 to 4.5.2
8.8
CVSS
6.2%
EPSS
No
On KEV
Description
A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Samba · Samba
4.0.0 through 4.0.26; 4.1.0 through 4.1.23; 4.2.0 through 4.2.14; 4.3.0 before 4.3.13; 4.4.0 before 4.4.8; 4.5.0 before 4.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2123
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2123
Third Party Advisory
http://www.securityfocus.com/bid/94970
Third Party Advisory
http://www.securitytracker.com/id/1037493
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2123
Patch
https://www.samba.org/samba/security/CVE-2016-2123.html
More from Samba
9.8
CVE-2017-7494
Samba Remote Code Execution Vulnerability
5.5
CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2023-3961
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
9.8
CVE-2022-45141
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable…