CVE-2012-6150
samba: pam_winbind fails open when non-existent group specified to require_membership_of
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · June 12, 2012
Updated · November 21, 2025
Description
The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 2.9AV:A/AC:H/Au:S/C:P/I:P/A:N
CWE not specified