Samba Shuts Down Vulnerability in AD Interface

Sep 12, 2007

The latest version of Samba, 3.0.26, removes a moderately critical vulnerability that only occurs in combination with Microsoft's Active Directory Service.

In some cases users were able to escalate privileges due to incorrect group assignments. The vulnerability was caused by faulty Winbind group assignments if users deployed the "winbind nss info - sfu" or "- rfc2307" plugins. For the attack to work, the primary group attributes had to be missing for "sfu" and "rfc2307".

According to the developers, Samba versions 3.0.25 through 3.0.25c are affected by the vulnerability. Besides the source code package, a patch for the new 3.0.26 version is also available as a download.

Related content

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News