VulnerabilityModified

CVE-2012-6150

LOW 3.6EPSS 3.79%

Does this matter?

Lower severity and a low EPSS score (3.79%). Track it; it rarely justifies an emergency change on its own.

Description

The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.

CVSS 2.0: 3.6 LOWAV:N/AC:H/Au:S/C:P/I:P/A:N
EPSS: 3.79% probability · 90th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-20
Affected: samba/samba · canonical/ubuntu linux
Source: secalert@redhat.com

EPSS trend

EPSS 3.8% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00002.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-03/msg00063.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=141660010015249&w=2Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2013/12/03/5Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0330.htmlThird Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:299Third Party Advisory
http://www.ubuntu.com/usn/USN-2054-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1036897Issue Tracking, Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=10300Issue Tracking, Patch, Third Party Advisory
https://lists.samba.org/archive/samba-technical/2012-June/084593.htmlExploit, Vendor Advisory
https://lists.samba.org/archive/samba-technical/2013-November/096411.htmlExploit, Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00002.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-03/msg00063.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=141660010015249&w=2Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2013/12/03/5Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0330.htmlThird Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:299Third Party Advisory
http://www.ubuntu.com/usn/USN-2054-1Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.