Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 2 Dec 2013 14:24:42 -0700
From: Vincent Danen <>
Subject: CVE request: samba pam_winbind authentication fails open

Just cutting-and-pasting from the bug I just filed.  The following was
reported to us, but had been reported upstream last year.

It was reported [1] that Samba's pam_winbind module would fail open (allowing
access) when the require_membership_of option is used as an argument to
pam_winbind, and contains a non-existent group as the value.  In such a
configuration, rather then failing and not permitting authentication which is
what would be expected, pam_winbind will allow authentication to proceed.

For instance, if the following is specified and the user is not a member of the
group 'Admin', they will not obtain access to the system:

auth        sufficient use_first_pass require_membership_of=Admin

On the other hand, if the non-existent group 'AdminOops' is specified, the user
is obviously not a member of said group, authentication will be permitted:

auth        sufficient use_first_pass require_membership_of=AdminOops

The commit [2] that most likely introduced this flaw indicates that this was
introduced October 2009 and another commit [3] looks like the fix, although
that is for another bug [4] that's somewhat related to this issue and somewhat


Could a CVE be assigned to this issue?

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.