Executive Summary
Summary | |
---|---|
Title | Sun Alert 271069 Two Security Vulnerabilities in SAMBA(7) May Allow Unauthorized Access to the Remote Root Filesystem or May Lead to a Denial of Service (DoS) Condition |
Informations | |||
---|---|---|---|
Name | SUN-271069 | First vendor Publication | 2009-11-17 |
Vendor | Sun | Last vendor Modification | 2010-02-11 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:S/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 6.8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
Product: SAMBA, Solaris 9, Solaris 10, OpenSolaris Two security vulnerabilities in SAMBA(7) may result in one or both ofthe following issues: 1. A remote unprivileged user with a valid SAMBA account may gainunauthorized access to the remote root file system. This issue isreferenced in the following CVE document: 2. A remote unprivileged user on an authenticated SAMBA connection maycause a Denial of Service (DoS) condition via specially crafted SMBrequests. This issue is referenced in the following CVE document: State: Resolved First released: 17-Nov-2009 |
Original Source
Url : http://blogs.sun.com/security/entry/sun_alert_271069_two_security |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:13061 | |||
Oval ID: | oval:org.mitre.oval:def:13061 | ||
Title: | DSA-1908-1 ntp -- denial of service | ||
Description: | Robin Park and Dmitri Vinokurov discovered that the daemon component of the ntp package, a reference implementation of the NTP protocol, is not properly reacting to certain incoming packets. An unexpected NTP mode 7 packets with spoofed IP data can lead ntpd to reply with a mode 7 response to the spoofed address. This may result in the service playing packet ping-pong with other ntp servers or even itself which causes CPU usage and excessive disk use due to logging. An attacker can use this to conduct denial of service attacks. For the oldstable distribution, this problem has been fixed in version 1:4.2.2.p4+dfsg-2etch4. For the stable distribution, this problem has been fixed in version 1:4.2.4p4+dfsg-8lenny3. For the testing and unstable distribution, this problem will be fixed soon. We recommend that you upgrade your ntp packages. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1908-1 CVE-2009-2948 CVE-2009-2906 CVE-2009-2813 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | ntp |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:7090 | |||
Oval ID: | oval:org.mitre.oval:def:7090 | ||
Title: | smbd DOS vulnerability via unanticipated oplock break notification reply packet | ||
Description: | smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-2906 | Version: | 5 |
Platform(s): | VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7211 | |||
Oval ID: | oval:org.mitre.oval:def:7211 | ||
Title: | Samba sharing restriction bypassing vulnerability | ||
Description: | Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-2813 | Version: | 5 |
Platform(s): | VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7257 | |||
Oval ID: | oval:org.mitre.oval:def:7257 | ||
Title: | HP-UX running HP CIFS Server (Samba), Remote Unauthorized Access | ||
Description: | Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-2813 | Version: | 11 |
Platform(s): | HP-UX 11 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:7791 | |||
Oval ID: | oval:org.mitre.oval:def:7791 | ||
Title: | HP-UX running HP CIFS Server (Samba), Remote Unauthorized Access | ||
Description: | Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-2813 | Version: | 11 |
Platform(s): | HP-UX 11 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:7895 | |||
Oval ID: | oval:org.mitre.oval:def:7895 | ||
Title: | DSA-1908 samba -- several vulnerabilities | ||
Description: | Several vulnerabilities have been discovered in samba, an implementation of the SMB/CIFS protocol for Unix systems, providing support for cross-platform file and printer sharing with other operating systems and more. The Common Vulnerabilities and Exposures project identifies the following problems: The mount.cifs utility is missing proper checks for file permissions when used in verbose mode. This allows local users to partly disclose the content of arbitrary files by specifying the file as credentials file and attempting to mount a samba share. A reply to an oplock break notification which samba doesn't expect could lead to the service getting stuck in an infinite loop. An attacker can use this to perform denial of service attacks via a specially crafted SMB request. A lack of error handling in case no home directory was configured/specified for the user could lead to file disclosure. In case the automated [homes] share is enabled or an explicit share is created with that username, samba fails to enforce sharing restrictions which results in an attacker being able to access the file system from the root directory. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1908 CVE-2009-2948 CVE-2009-2906 CVE-2009-2813 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 | Product(s): | samba |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9191 | |||
Oval ID: | oval:org.mitre.oval:def:9191 | ||
Title: | Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories. | ||
Description: | Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-2813 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9944 | |||
Oval ID: | oval:org.mitre.oval:def:9944 | ||
Title: | smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet. | ||
Description: | smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-2906 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-08-10 | Name : Gentoo Security Advisory GLSA 201206-22 (Samba) File : nvt/glsa_201206_22.nasl |
2011-08-09 | Name : CentOS Update for samba CESA-2009:1528 centos3 i386 File : nvt/gb_CESA-2009_1528_samba_centos3_i386.nasl |
2011-08-09 | Name : CentOS Update for samba CESA-2009:1529 centos4 i386 File : nvt/gb_CESA-2009_1529_samba_centos4_i386.nasl |
2011-08-09 | Name : CentOS Update for samba CESA-2009:1529 centos5 i386 File : nvt/gb_CESA-2009_1529_samba_centos5_i386.nasl |
2010-05-12 | Name : Mac OS X 10.6.3 Update / Mac OS X Security Update 2010-002 File : nvt/macosx_upd_10_6_3_secupd_2010-002.nasl |
2010-05-12 | Name : Mac OS X Security Update 2009-005 File : nvt/macosx_secupd_2009-005.nasl |
2010-03-12 | Name : Fedora Update for samba FEDORA-2010-4050 File : nvt/gb_fedora_2010_4050_samba_fc11.nasl |
2010-03-02 | Name : Fedora Update for samba FEDORA-2010-1190 File : nvt/gb_fedora_2010_1190_samba_fc11.nasl |
2010-02-08 | Name : HP-UX Update for HP CIFS Server (Samba) HPSBUX02479 File : nvt/gb_hp_ux_HPSBUX02479.nasl |
2009-12-10 | Name : Mandriva Security Advisory MDVSA-2009:320 (samba) File : nvt/mdksa_2009_320.nasl |
2009-11-17 | Name : RedHat Security Advisory RHSA-2009:1585 File : nvt/RHSA_2009_1585.nasl |
2009-11-11 | Name : RedHat Security Advisory RHSA-2009:1529 File : nvt/RHSA_2009_1529.nasl |
2009-11-11 | Name : CentOS Security Advisory CESA-2009:1529 (samba) File : nvt/ovcesa2009_1529.nasl |
2009-11-11 | Name : CentOS Security Advisory CESA-2009:1528 (samba) File : nvt/ovcesa2009_1528.nasl |
2009-11-11 | Name : RedHat Security Advisory RHSA-2009:1528 File : nvt/RHSA_2009_1528.nasl |
2009-10-27 | Name : SLES10: Security update for Samba File : nvt/sles10_cifs-mount2.nasl |
2009-10-27 | Name : SLES11: Security update for Samba File : nvt/sles11_cifs-mount0.nasl |
2009-10-27 | Name : SLES9: Security update for Samba File : nvt/sles9p5060841.nasl |
2009-10-27 | Name : SuSE Security Summary SUSE-SR:2009:017 File : nvt/suse_sr_2009_017.nasl |
2009-10-19 | Name : Mandrake Security Advisory MDVSA-2009:277 (samba) File : nvt/mdksa_2009_277.nasl |
2009-10-19 | Name : Debian Security Advisory DSA 1908-1 (samba) File : nvt/deb_1908_1.nasl |
2009-10-15 | Name : Samba multiple vulnerabilities File : nvt/samba_multiple_vulnerabilities.nasl |
2009-10-06 | Name : Fedora Core 11 FEDORA-2009-10180 (samba) File : nvt/fcore_2009_10180.nasl |
2009-10-06 | Name : Fedora Core 10 FEDORA-2009-10172 (samba) File : nvt/fcore_2009_10172.nasl |
2009-10-06 | Name : Ubuntu USN-839-1 (samba) File : nvt/ubuntu_839_1.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2009-276-01 samba File : nvt/esoft_slk_ssa_2009_276_01.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
58519 | Samba smbd Crafted SMB Request Remote CPU Consumption DoS Samba contains a flaw that may allow a remote denial of service. The issue is triggered when a malicious user sends an unexpected reply to an oplock break notification, and will result in loss of availability for the service. |
57955 | Samba Unconfigured Home Directory Windows File Share Directory Access Restric... |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-03-08 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0006_remote.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1529.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1528.nasl - Type : ACT_GATHER_INFO |
2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1585.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20091027_samba_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
2012-06-25 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-22.nasl - Type : ACT_GATHER_INFO |
2011-05-28 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2009-276-01.nasl - Type : ACT_GATHER_INFO |
2011-01-21 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_cifs-mount-090930.nasl - Type : ACT_GATHER_INFO |
2010-10-11 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_cifs-mount-6551.nasl - Type : ACT_GATHER_INFO |
2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-1190.nasl - Type : ACT_GATHER_INFO |
2010-04-02 | Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2010-0006.nasl - Type : ACT_GATHER_INFO |
2010-03-29 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_6_3.nasl - Type : ACT_GATHER_INFO |
2010-03-29 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2010-002.nasl - Type : ACT_GATHER_INFO |
2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1908.nasl - Type : ACT_GATHER_INFO |
2009-12-07 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-320.nasl - Type : ACT_GATHER_INFO |
2009-10-30 | Name : The remote openSUSE host is missing a security update. File : suse_cifs-mount-6519.nasl - Type : ACT_GATHER_INFO |
2009-10-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1528.nasl - Type : ACT_GATHER_INFO |
2009-10-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1529.nasl - Type : ACT_GATHER_INFO |
2009-10-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1529.nasl - Type : ACT_GATHER_INFO |
2009-10-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1528.nasl - Type : ACT_GATHER_INFO |
2009-10-23 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12518.nasl - Type : ACT_GATHER_INFO |
2009-10-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_cifs-mount-090930.nasl - Type : ACT_GATHER_INFO |
2009-10-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_cifs-mount-090930.nasl - Type : ACT_GATHER_INFO |
2009-10-23 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_cifs-mount-091001.nasl - Type : ACT_GATHER_INFO |
2009-10-23 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_cifs-mount-6518.nasl - Type : ACT_GATHER_INFO |
2009-10-15 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-277.nasl - Type : ACT_GATHER_INFO |
2009-10-05 | Name : The remote Fedora host is missing a security update. File : fedora_2009-10180.nasl - Type : ACT_GATHER_INFO |
2009-10-05 | Name : The remote Fedora host is missing a security update. File : fedora_2009-10172.nasl - Type : ACT_GATHER_INFO |
2009-10-02 | Name : The remote Samba server may be affected by multiple vulnerabilities. File : samba_3_2_15.nasl - Type : ACT_GATHER_INFO |
2009-10-02 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-839-1.nasl - Type : ACT_GATHER_INFO |
2009-09-11 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-005.nasl - Type : ACT_GATHER_INFO |