8.3 - USN-2054-1

Executive Summary

Summary
Title	Samba vulnerabilities

Informations
Name	USN-2054-1	First vendor Publication	2013-12-11
Vendor	Ubuntu	Last vendor Modification	2013-12-11
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:A/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	8.3	Attack Range	Adjacent network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	6.5	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10 - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Samba.

Software Description: - samba: SMB/CIFS file, print, and login server for Unix

Details:

It was discovered that Winbind incorrectly handled invalid group names with the require_membership_of parameter. If an administrator used an invalid group name by mistake, access was granted instead of having the login fail. (CVE-2012-6150)

Stefan Metzmacher and Michael Adam discovered that Samba incorrectly handled DCE-RPC fragment length fields. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code as the root user. (CVE-2013-4408)

Hemanth Thummala discovered that Samba incorrectly handled file permissions when vfs_streams_depot or vfs_streams_xattr were enabled. A remote attacker could use this issue to bypass intended restrictions. (CVE-2013-4475)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 13.10:
libpam-winbind 2:3.6.18-1ubuntu3.1
samba 2:3.6.18-1ubuntu3.1

Ubuntu 13.04:
libpam-winbind 2:3.6.9-1ubuntu1.2
samba 2:3.6.9-1ubuntu1.2

Ubuntu 12.10:
libpam-winbind 2:3.6.6-3ubuntu5.3
samba 2:3.6.6-3ubuntu5.3

Ubuntu 12.04 LTS:
libpam-winbind 2:3.6.3-2ubuntu2.9
samba 2:3.6.3-2ubuntu2.9

Ubuntu 10.04 LTS:
samba 2:3.4.7~dfsg-1ubuntu3.13
winbind 2:3.4.7~dfsg-1ubuntu3.13

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2054-1
CVE-2012-6150, CVE-2013-4408, CVE-2013-4475

Package Information:
https://launchpad.net/ubuntu/+source/samba/2:3.6.18-1ubuntu3.1
https://launchpad.net/ubuntu/+source/samba/2:3.6.9-1ubuntu1.2
https://launchpad.net/ubuntu/+source/samba/2:3.6.6-3ubuntu5.3
https://launchpad.net/ubuntu/+source/samba/2:3.6.3-2ubuntu2.9
https://launchpad.net/ubuntu/+source/samba/2:3.4.7~dfsg-1ubuntu3.13

Original Source

Url : http://www.ubuntu.com/usn/USN-2054-1

CWE : Common Weakness Enumeration

%	Id	Name
33 %	CWE-264	Permissions, Privileges, and Access Controls
33 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
33 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20652

Oval ID:	oval:org.mitre.oval:def:20652
Title:	USN-2054-1 -- samba vulnerabilities
Description:	Several security issues were fixed in Samba.
Family:	unix	Class:	patch
Reference(s):	USN-2054-1 CVE-2012-6150 CVE-2013-4408 CVE-2013-4475	Version:	5
Platform(s):	Ubuntu 13.10 Ubuntu 13.04 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04	Product(s):	samba
Definition Synopsis:
Release section Ubuntu 13.10 is installed Packages match section libpam-winbind DPKG is earlier than 2:3.6.18-1ubuntu3.1 AND samba DPKG is earlier than 2:3.6.18-1ubuntu3.1 AND Release section Ubuntu 13.04 is installed Packages match section libpam-winbind DPKG is earlier than 2:3.6.9-1ubuntu1.2 AND samba DPKG is earlier than 2:3.6.9-1ubuntu1.2 AND Release section Ubuntu 12.10 is installed Packages match section libpam-winbind DPKG is earlier than 2:3.6.6-3ubuntu5.3 AND samba DPKG is earlier than 2:3.6.6-3ubuntu5.3 AND Release section Ubuntu 12.04 is installed Packages match section libpam-winbind DPKG is earlier than 2:3.6.3-2ubuntu2.9 AND samba DPKG is earlier than 2:3.6.3-2ubuntu2.9 AND Release section Ubuntu 10.04 is installed Packages match section samba DPKG is earlier than 2:3.4.7~dfsg-1ubuntu3.13 AND winbind DPKG is earlier than 2:3.4.7~dfsg-1ubuntu3.13

Definition Id: oval:org.mitre.oval:def:20816

Oval ID:	oval:org.mitre.oval:def:20816
Title:	RHSA-2013:1805: samba4 security update (Important)
Description:	Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
Family:	unix	Class:	patch
Reference(s):	RHSA-2013:1805-00 CESA-2013:1805 CVE-2013-4408	Version:	4
Platform(s):	Red Hat Enterprise Linux 6 CentOS Linux 6	Product(s):	samba4
Definition Synopsis:
Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND CentOS Linux 6.x Packages section samba4-winbind-krb5-locator is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-dc-libs is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-winbind-clients is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-pidl is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-swat is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-libs is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-test is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-python is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-common is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-dc is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4 is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-client is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-winbind is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-devel is earlier than 0:4.0.0-60.el6_5.rc4

Definition Id: oval:org.mitre.oval:def:20821

Oval ID:	oval:org.mitre.oval:def:20821
Title:	DSA-2812-1 samba - several
Description:	Two security issues were found in Samba, a SMB/CIFS file, print, and login server.
Family:	unix	Class:	patch
Reference(s):	DSA-2812-1 CVE-2013-4408 CVE-2013-4475	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7	Product(s):	samba
Definition Synopsis:
Release section Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND samba DPKG is earlier than 2:3.5.6~dfsg-3squeeze11 AND Release section Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND samba DPKG is earlier than 2:3.6.6-6+deb7u2

Definition Id: oval:org.mitre.oval:def:21206

Oval ID:	oval:org.mitre.oval:def:21206
Title:	RHSA-2013:1806: samba and samba3x security update (Important)
Description:	Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).
Family:	unix	Class:	patch
Reference(s):	RHSA-2013:1806-00 CESA-2013:1806 CVE-2013-4408 CVE-2013-4475	Version:	31
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6	Product(s):	samba3x samba
Definition Synopsis:
Operation system section Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x Packages section samba3x is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-common is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-doc is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-swat is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-domainjoin-gui is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-client is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind-devel is earlier than 0:3.6.6-0.138.el5_10 AND Operation system section Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND CentOS Linux 6.x Packages section samba-common is earlier than 0:3.6.9-167.el6_5 AND samba is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-clients is earlier than 0:3.6.9-167.el6_5 AND samba-winbind is earlier than 0:3.6.9-167.el6_5 AND samba-client is earlier than 0:3.6.9-167.el6_5 AND samba-doc is earlier than 0:3.6.9-167.el6_5 AND libsmbclient is earlier than 0:3.6.9-167.el6_5 AND samba-swat is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-devel is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-krb5-locator is earlier than 0:3.6.9-167.el6_5 AND samba-domainjoin-gui is earlier than 0:3.6.9-167.el6_5 AND libsmbclient-devel is earlier than 0:3.6.9-167.el6_5

Definition Id: oval:org.mitre.oval:def:23482

Oval ID:	oval:org.mitre.oval:def:23482
Title:	DEPRECATED: ELSA-2013:1806: samba and samba3x security update (Important)
Description:	Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:1806-00 CVE-2013-4408 CVE-2013-4475	Version:	14
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	samba3x samba
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test samba3x is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-common is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-doc is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-swat is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-domainjoin-gui is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-client is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind-devel is earlier than 0:3.6.6-0.138.el5_10 OR rpm test Oracle Linux 6.x AND rpm test samba-common is earlier than 0:3.6.9-167.el6_5 AND samba is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-clients is earlier than 0:3.6.9-167.el6_5 AND samba-winbind is earlier than 0:3.6.9-167.el6_5 AND samba-client is earlier than 0:3.6.9-167.el6_5 AND samba-doc is earlier than 0:3.6.9-167.el6_5 AND libsmbclient is earlier than 0:3.6.9-167.el6_5 AND samba-swat is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-devel is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-krb5-locator is earlier than 0:3.6.9-167.el6_5 AND samba-domainjoin-gui is earlier than 0:3.6.9-167.el6_5 AND libsmbclient-devel is earlier than 0:3.6.9-167.el6_5

Definition Id: oval:org.mitre.oval:def:23855

Oval ID:	oval:org.mitre.oval:def:23855
Title:	ELSA-2013:1806: samba and samba3x security update (Important)
Description:	Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:1806-00 CVE-2013-4408 CVE-2013-4475	Version:	13
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	samba3x samba
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test samba3x is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-common is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-doc is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-swat is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-domainjoin-gui is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-client is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind-devel is earlier than 0:3.6.6-0.138.el5_10 OR rpm test Oracle Linux 6.x AND rpm test samba-common is earlier than 0:3.6.9-167.el6_5 AND samba is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-clients is earlier than 0:3.6.9-167.el6_5 AND samba-winbind is earlier than 0:3.6.9-167.el6_5 AND samba-client is earlier than 0:3.6.9-167.el6_5 AND samba-doc is earlier than 0:3.6.9-167.el6_5 AND libsmbclient is earlier than 0:3.6.9-167.el6_5 AND samba-swat is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-devel is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-krb5-locator is earlier than 0:3.6.9-167.el6_5 AND samba-domainjoin-gui is earlier than 0:3.6.9-167.el6_5 AND libsmbclient-devel is earlier than 0:3.6.9-167.el6_5

Definition Id: oval:org.mitre.oval:def:24000

Oval ID:	oval:org.mitre.oval:def:24000
Title:	ELSA-2013:1805: samba4 security update (Important)
Description:	Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:1805-00 CVE-2013-4408	Version:	6
Platform(s):	Oracle Linux 6	Product(s):	samba4
Definition Synopsis:
Oracle Linux 6.x rpm test samba4-winbind-krb5-locator is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-dc-libs is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-winbind-clients is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-pidl is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-swat is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-libs is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-test is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-python is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-common is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-dc is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4 is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-client is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-winbind is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-devel is earlier than 0:4.0.0-60.el6_5.rc4

Definition Id: oval:org.mitre.oval:def:24798

Oval ID:	oval:org.mitre.oval:def:24798
Title:	SUSE-SU-2014:0723-1 -- Security update for Samba
Description:	This is a LTSS roll-up update for the Samba Server suite fixing multiple security issues and bugs. Security issues fixed: * CVE-2013-4496: Password lockout was not enforced for SAMR password changes, leading to brute force possibility. * CVE-2013-4408: DCE-RPC fragment length field is incorrectly checked. * CVE-2013-4124: Samba was affected by a denial of service attack on authenticated or guest connections. * CVE-2013-0214: The SWAT webadministration was affected by a cross site scripting attack (XSS). * CVE-2013-0213: The SWAT webadministration could possibly be used in clickjacking attacks.
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:0723-1 CVE-2013-4496 CVE-2013-4408 CVE-2013-4124 CVE-2013-0214 CVE-2013-0213 CVE-2012-6150	Version:	3
Platform(s):	SUSE Linux Enterprise Server 11	Product(s):	Samba
Definition Synopsis:
SUSE Linux Enterprise Server 11.x is installed Packages match section cifs-mount RPM is earlier than 0:3.4.3-1.52.3 AND ldapsmb RPM is earlier than 0:1.34b-11.28.52.3 AND libsmbclient0 RPM is earlier than 0:3.4.3-1.52.3 AND libtalloc1 RPM is earlier than 0:3.4.3-1.52.3 AND libtdb1 RPM is earlier than 0:3.4.3-1.52.3 AND libwbclient0 RPM is earlier than 0:3.4.3-1.52.3 AND samba RPM is earlier than 0:3.4.3-1.52.3 AND samba-client RPM is earlier than 0:3.4.3-1.52.3 AND samba-krb-printing RPM is earlier than 0:3.4.3-1.52.3 AND samba-winbind RPM is earlier than 0:3.4.3-1.52.3 AND libsmbclient0-32bit RPM is earlier than 0:3.4.3-1.52.3 AND libtalloc1-32bit RPM is earlier than 0:3.4.3-1.52.3 AND libtdb1-32bit RPM is earlier than 0:3.4.3-1.52.3 AND libwbclient0-32bit RPM is earlier than 0:3.4.3-1.52.3 AND samba-32bit RPM is earlier than 0:3.4.3-1.52.3 AND samba-client-32bit RPM is earlier than 0:3.4.3-1.52.3 AND samba-winbind-32bit RPM is earlier than 0:3.4.3-1.52.3 AND samba-doc RPM is earlier than 0:3.4.3-1.52.3

Definition Id: oval:org.mitre.oval:def:25148

Oval ID:	oval:org.mitre.oval:def:25148
Title:	SUSE-SU-2014:0024-1 -- Security update for Samba
Description:	This update fixes the following security issues with Samba: * bnc#844720: DCERPC frag_len not checked (CVE-2013-4408) * bnc#853347: winbind pam security problem (CVE-2012-6150) * bnc#848101: No access check verification on stream files (CVE-2013-4475) And fixes the following non-security issues: * bnc#853021: libsmbclient0 package description contains comments * bnc#817880: rpcclient adddriver and setdrive do not set all needed registry entries * bnc#838472: Client trying to delete print job fails: Samba returns: WERR_INVALID_PRINTER_NAME * bnc#854520 and bnc#849226: various upstream fixes
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:0024-1 CVE-2013-4408 CVE-2012-6150 CVE-2013-4475	Version:	3
Platform(s):	SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11	Product(s):	Samba
Definition Synopsis:
SUSE Linux Enterprise Server 11 release section SUSE Linux Enterprise Server 11.x is installed Packages match section ldapsmb RPM is earlier than 0:1.34b-12.46.1 AND ldapsmb RPM is earlier than 0:1.34b-12.33.39.1 AND SUSE Linux Enterprise Server 11 and SUSE Linux Enterprise Desktop 11 release section Operation system section SUSE Linux Enterprise Server 11.x is installed AND SUSE Linux Enterprise Desktop 11.x is installed Packages match section libldb1 RPM is earlier than 0:3.6.3-0.46.1 AND libsmbclient0 RPM is earlier than 0:3.6.3-0.46.1 AND libtalloc2 RPM is earlier than 0:3.6.3-0.46.1 AND libtdb1 RPM is earlier than 0:3.6.3-0.46.1 AND libtevent0 RPM is earlier than 0:3.6.3-0.46.1 AND libwbclient0 RPM is earlier than 0:3.6.3-0.46.1 AND samba RPM is earlier than 0:3.6.3-0.46.1 AND samba-client RPM is earlier than 0:3.6.3-0.46.1 AND samba-krb-printing RPM is earlier than 0:3.6.3-0.46.1 AND samba-winbind RPM is earlier than 0:3.6.3-0.46.1 AND libsmbclient0-32bit RPM is earlier than 0:3.6.3-0.46.1 AND libtalloc2-32bit RPM is earlier than 0:3.6.3-0.46.1 AND libtdb1-32bit RPM is earlier than 0:3.6.3-0.46.1 AND libtevent0-32bit RPM is earlier than 0:3.6.3-0.46.1 AND libwbclient0-32bit RPM is earlier than 0:3.6.3-0.46.1 AND samba-32bit RPM is earlier than 0:3.6.3-0.46.1 AND samba-client-32bit RPM is earlier than 0:3.6.3-0.46.1 AND samba-winbind-32bit RPM is earlier than 0:3.6.3-0.46.1 AND samba-doc RPM is earlier than 0:3.6.3-0.46.1 AND libldb1 RPM is earlier than 0:3.6.3-0.33.39.1 AND libsmbclient0 RPM is earlier than 0:3.6.3-0.33.39.1 AND libtalloc1 RPM is earlier than 0:3.4.3-1.50.1 AND libtalloc2 RPM is earlier than 0:3.6.3-0.33.39.1 AND libtdb1 RPM is earlier than 0:3.6.3-0.33.39.1 AND libtevent0 RPM is earlier than 0:3.6.3-0.33.39.1 AND libwbclient0 RPM is earlier than 0:3.6.3-0.33.39.1 AND samba RPM is earlier than 0:3.6.3-0.33.39.1 AND samba-client RPM is earlier than 0:3.6.3-0.33.39.1 AND samba-krb-printing RPM is earlier than 0:3.6.3-0.33.39.1 AND samba-winbind RPM is earlier than 0:3.6.3-0.33.39.1 AND libsmbclient0-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND libtalloc1-32bit RPM is earlier than 0:3.4.3-1.50.1 AND libtalloc2-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND libtdb1-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND libtevent0-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND libwbclient0-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND samba-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND samba-client-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND samba-winbind-32bit RPM is earlier than 0:3.6.3-0.33.39.1 AND samba-doc RPM is earlier than 0:3.6.3-0.33.39.1 AND SUSE Linux Enterprise Desktop 11 release section SUSE Linux Enterprise Desktop 11.x is installed Packages match section libldb1-32bit RPM is earlier than 0:3.6.3-0.46.1 AND libldb1-32bit RPM is earlier than 0:3.6.3-0.33.39.1

Definition Id: oval:org.mitre.oval:def:25899

Oval ID:	oval:org.mitre.oval:def:25899
Title:	HP-UX CIFS Server (Samba), Remote Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Access
Description:	Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2013-4408	Version:	8
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.02 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.02 AND CIFS-Server.CIFS-DOC version is less than A.03.02.02 AND CIFS-Server.CIFS-LIB version is less than A.03.02.02 AND CIFS-Server.CIFS-RUN version is less than A.03.02.02 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.02 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.01 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.01 AND CIFS-Server.CIFS-DOC version is less than A.03.02.01 AND CIFS-Server.CIFS-LIB version is less than A.03.02.01 AND CIFS-Server.CIFS-RUN version is less than A.03.02.01 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.01 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.00 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.00 AND CIFS-Server.CIFS-DOC version is less than A.03.02.00 AND CIFS-Server.CIFS-LIB version is less than A.03.02.00 AND CIFS-Server.CIFS-RUN version is less than A.03.02.00 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.00 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.06 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.06 AND CIFS-Server.CIFS-DOC version is less than A.03.01.06 AND CIFS-Server.CIFS-LIB version is less than A.03.01.06 AND CIFS-Server.CIFS-RUN version is less than A.03.01.06 AND CIFS-CFSM.CFSM-KRN version is less than A.03.01.06 AND CIFS-CFSM.CFSM-RUN version is less than A.03.01.06 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.05 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.05 AND CIFS-Server.CIFS-DOC version is less than A.03.01.05 AND CIFS-Server.CIFS-LIB version is less than A.03.01.05 AND CIFS-Server.CIFS-RUN version is less than A.03.01.05 AND CIFS-Server.CIFS-UTIL version is less than A.03.01.05 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.02 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.02 AND CIFS-Server.CIFS-DOC version is less than A.03.02.02 AND CIFS-Server.CIFS-LIB version is less than A.03.02.02 AND CIFS-Server.CIFS-RUN version is less than A.03.02.02 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.02 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.00 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.00 AND CIFS-Server.CIFS-DOC version is less than A.03.02.00 AND CIFS-Server.CIFS-LIB version is less than A.03.02.00 AND CIFS-Server.CIFS-RUN version is less than A.03.02.00 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.00 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.07 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.07 AND CIFS-Server.CIFS-DOC version is less than A.03.01.07 AND CIFS-Server.CIFS-LIB version is less than A.03.01.07 AND CIFS-Server.CIFS-RUN version is less than A.03.01.07 AND CIFS-Server.CIFS-UTIL version is less than A.03.01.07 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.05 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.05 AND CIFS-Server.CIFS-DOC version is less than A.03.01.05 AND CIFS-Server.CIFS-LIB version is less than A.03.01.05 AND CIFS-Server.CIFS-RUN version is less than A.03.01.05 AND CIFS-Server.CIFS-UTIL version is less than A.03.01.05 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.11 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.02.04.06 AND CIFS-Server.CIFS-ADMIN version is less than A.02.04.06 AND CIFS-Server.CIFS-DOC version is less than A.02.04.06 AND CIFS-Server.CIFS-LIB version is less than A.02.04.06 AND CIFS-Server.CIFS-RUN version is less than A.02.04.06 AND CIFS-Server.CIFS-UTIL version is less than A.02.04.06 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.11 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.02.03.06 AND CIFS-Server.CIFS-ADMIN version is less than A.02.03.06 AND CIFS-Server.CIFS-DOC version is less than A.02.03.06 AND CIFS-Server.CIFS-LIB version is less than A.02.03.06 AND CIFS-Server.CIFS-RUN version is less than A.02.03.06 AND CIFS-Server.CIFS-UTIL version is less than A.02.03.06

Definition Id: oval:org.mitre.oval:def:26318

Oval ID:	oval:org.mitre.oval:def:26318
Title:	SUSE-SU-2014:0839-1 -- Security update for Samba
Description:	Samba, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:0839-1 CVE-2013-4475	Version:	3
Platform(s):	SUSE Linux Enterprise Server 11	Product(s):	Samba
Definition Synopsis:
SUSE Linux Enterprise Server 11.x is installed Packages match section cifs-mount RPM is earlier than 0:3.4.3-1.54.1 AND ldapsmb RPM is earlier than 0:1.34b-11.28.54.1 AND libsmbclient0 RPM is earlier than 0:3.4.3-1.54.1 AND libtalloc1 RPM is earlier than 0:3.4.3-1.54.1 AND libtdb1 RPM is earlier than 0:3.4.3-1.54.1 AND libwbclient0 RPM is earlier than 0:3.4.3-1.54.1 AND samba RPM is earlier than 0:3.4.3-1.54.1 AND samba-client RPM is earlier than 0:3.4.3-1.54.1 AND samba-krb-printing RPM is earlier than 0:3.4.3-1.54.1 AND samba-winbind RPM is earlier than 0:3.4.3-1.54.1 AND libsmbclient0-32bit RPM is earlier than 0:3.4.3-1.54.1 AND libtalloc1-32bit RPM is earlier than 0:3.4.3-1.54.1 AND libtdb1-32bit RPM is earlier than 0:3.4.3-1.54.1 AND libwbclient0-32bit RPM is earlier than 0:3.4.3-1.54.1 AND samba-32bit RPM is earlier than 0:3.4.3-1.54.1 AND samba-client-32bit RPM is earlier than 0:3.4.3-1.54.1 AND samba-winbind-32bit RPM is earlier than 0:3.4.3-1.54.1 AND samba-doc RPM is earlier than 0:3.4.3-1.54.1

Definition Id: oval:org.mitre.oval:def:26319

Oval ID:	oval:org.mitre.oval:def:26319
Title:	HP-UX CIFS Server (Samba), Remote Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Access
Description:	The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2012-6150	Version:	8
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.02 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.02 AND CIFS-Server.CIFS-DOC version is less than A.03.02.02 AND CIFS-Server.CIFS-LIB version is less than A.03.02.02 AND CIFS-Server.CIFS-RUN version is less than A.03.02.02 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.02 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.01 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.01 AND CIFS-Server.CIFS-DOC version is less than A.03.02.01 AND CIFS-Server.CIFS-LIB version is less than A.03.02.01 AND CIFS-Server.CIFS-RUN version is less than A.03.02.01 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.01 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.00 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.00 AND CIFS-Server.CIFS-DOC version is less than A.03.02.00 AND CIFS-Server.CIFS-LIB version is less than A.03.02.00 AND CIFS-Server.CIFS-RUN version is less than A.03.02.00 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.00 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.06 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.06 AND CIFS-Server.CIFS-DOC version is less than A.03.01.06 AND CIFS-Server.CIFS-LIB version is less than A.03.01.06 AND CIFS-Server.CIFS-RUN version is less than A.03.01.06 AND CIFS-CFSM.CFSM-KRN version is less than A.03.01.06 AND CIFS-CFSM.CFSM-RUN version is less than A.03.01.06 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.31 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.05 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.05 AND CIFS-Server.CIFS-DOC version is less than A.03.01.05 AND CIFS-Server.CIFS-LIB version is less than A.03.01.05 AND CIFS-Server.CIFS-RUN version is less than A.03.01.05 AND CIFS-Server.CIFS-UTIL version is less than A.03.01.05 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.02 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.02 AND CIFS-Server.CIFS-DOC version is less than A.03.02.02 AND CIFS-Server.CIFS-LIB version is less than A.03.02.02 AND CIFS-Server.CIFS-RUN version is less than A.03.02.02 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.02 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.02.00 AND CIFS-Server.CIFS-ADMIN version is less than A.03.02.00 AND CIFS-Server.CIFS-DOC version is less than A.03.02.00 AND CIFS-Server.CIFS-LIB version is less than A.03.02.00 AND CIFS-Server.CIFS-RUN version is less than A.03.02.00 AND CIFS-Server.CIFS-UTIL version is less than A.03.02.00 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.07 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.07 AND CIFS-Server.CIFS-DOC version is less than A.03.01.07 AND CIFS-Server.CIFS-LIB version is less than A.03.01.07 AND CIFS-Server.CIFS-RUN version is less than A.03.01.07 AND CIFS-Server.CIFS-UTIL version is less than A.03.01.07 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.23 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.03.01.05 AND CIFS-Server.CIFS-ADMIN version is less than A.03.01.05 AND CIFS-Server.CIFS-DOC version is less than A.03.01.05 AND CIFS-Server.CIFS-LIB version is less than A.03.01.05 AND CIFS-Server.CIFS-RUN version is less than A.03.01.05 AND CIFS-Server.CIFS-UTIL version is less than A.03.01.05 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.11 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.02.04.06 AND CIFS-Server.CIFS-ADMIN version is less than A.02.04.06 AND CIFS-Server.CIFS-DOC version is less than A.02.04.06 AND CIFS-Server.CIFS-LIB version is less than A.02.04.06 AND CIFS-Server.CIFS-RUN version is less than A.02.04.06 AND CIFS-Server.CIFS-UTIL version is less than A.02.04.06 OR Criteria meets HP Security Bulletin HPSBUX03087 HP-UX B.11.11 AND filesets tests CIFS-Development.CIFS-PRG version is less than A.02.03.06 AND CIFS-Server.CIFS-ADMIN version is less than A.02.03.06 AND CIFS-Server.CIFS-DOC version is less than A.02.03.06 AND CIFS-Server.CIFS-LIB version is less than A.02.03.06 AND CIFS-Server.CIFS-RUN version is less than A.02.03.06 AND CIFS-Server.CIFS-UTIL version is less than A.02.03.06

Definition Id: oval:org.mitre.oval:def:27279

Oval ID:	oval:org.mitre.oval:def:27279
Title:	DEPRECATED: ELSA-2013-1806 -- samba and samba3x security update (important)
Description:	[3.6.9-167] - resolves: #1018037 - Fix CVE-2013-4408. [3.6.9-165] - resolves: #1028086 - Fix CVE-2013-4475.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013-1806 CVE-2013-4408 CVE-2013-4475	Version:	4
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	samba3x samba
Definition Synopsis:
Oracle Linux 5 release section Oracle Linux 5.x Packages match section samba3x is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-client is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-common is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-doc is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-domainjoin-gui is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-swat is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind is earlier than 0:3.6.6-0.138.el5_10 AND samba3x-winbind-devel is earlier than 0:3.6.6-0.138.el5_10 AND Oracle Linux 6 release section Oracle Linux 6.x Packages match section samba is earlier than 0:3.6.9-167.el6_5 AND libsmbclient is earlier than 0:3.6.9-167.el6_5 AND libsmbclient-devel is earlier than 0:3.6.9-167.el6_5 AND samba-client is earlier than 0:3.6.9-167.el6_5 AND samba-common is earlier than 0:3.6.9-167.el6_5 AND samba-doc is earlier than 0:3.6.9-167.el6_5 AND samba-domainjoin-gui is earlier than 0:3.6.9-167.el6_5 AND samba-swat is earlier than 0:3.6.9-167.el6_5 AND samba-winbind is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-clients is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-devel is earlier than 0:3.6.9-167.el6_5 AND samba-winbind-krb5-locator is earlier than 0:3.6.9-167.el6_5

Definition Id: oval:org.mitre.oval:def:27420

Oval ID:	oval:org.mitre.oval:def:27420
Title:	DEPRECATED: ELSA-2013-1805 -- samba4 security update (important)
Description:	[4.0.0-60.rc4] - resolves: #1018039 - Fix CVE-2013-4408. [4.0.0-59.rc4] - Fix usage of client min/max protocol options in winbindd - related: #949993
Family:	unix	Class:	patch
Reference(s):	ELSA-2013-1805 CVE-2013-4408	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	samba4
Definition Synopsis:
Oracle Linux 6.x Packages match section samba4 is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-client is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-common is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-dc is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-dc-libs is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-devel is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-libs is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-pidl is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-python is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-swat is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-test is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-winbind is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-winbind-clients is earlier than 0:4.0.0-60.el6_5.rc4 AND samba4-winbind-krb5-locator is earlier than 0:4.0.0-60.el6_5.rc4

CPE : Common Platform Enumeration

Type	Description	Count
Application	Samba cpe:2.3:a:samba:samba:4.1.2:::::::* cpe:2.3:a:samba:samba:4.1.1:::::::* cpe:2.3:a:samba:samba:4.1.0:::::::* cpe:2.3:a:samba:samba:4.0.9:::::::* cpe:2.3:a:samba:samba:4.0.8:::::::* cpe:2.3:a:samba:samba:4.0.7:::::::* cpe:2.3:a:samba:samba:4.0.6:::::::* cpe:2.3:a:samba:samba:4.0.5:::::::* cpe:2.3:a:samba:samba:4.0.4:::::::* cpe:2.3:a:samba:samba:4.0.3:::::::* cpe:2.3:a:samba:samba:4.0.26:::::::* cpe:2.3:a:samba:samba:4.0.25:::::::* cpe:2.3:a:samba:samba:4.0.24:::::::* cpe:2.3:a:samba:samba:4.0.23:::::::* cpe:2.3:a:samba:samba:4.0.22:::::::* cpe:2.3:a:samba:samba:4.0.21:::::::* cpe:2.3:a:samba:samba:4.0.20:::::::* cpe:2.3:a:samba:samba:4.0.2:::::::* cpe:2.3:a:samba:samba:4.0.19:::::::* cpe:2.3:a:samba:samba:4.0.18:::::::* cpe:2.3:a:samba:samba:4.0.17:::::::* cpe:2.3:a:samba:samba:4.0.16:::::::* cpe:2.3:a:samba:samba:4.0.15:::::::* cpe:2.3:a:samba:samba:4.0.14:::::::* cpe:2.3:a:samba:samba:4.0.13:::::::* cpe:2.3:a:samba:samba:4.0.12:::::::* cpe:2.3:a:samba:samba:4.0.11:::::::* cpe:2.3:a:samba:samba:4.0.10:::::::* cpe:2.3:a:samba:samba:4.0.1:::::::* cpe:2.3:a:samba:samba:4.0.0:::::::* cpe:2.3:a:samba:samba:3.6.9:::::::* cpe:2.3:a:samba:samba:3.6.8:::::::* cpe:2.3:a:samba:samba:3.6.7:::::::* cpe:2.3:a:samba:samba:3.6.6:::::::* cpe:2.3:a:samba:samba:3.6.5:::::::* cpe:2.3:a:samba:samba:3.6.4:::::::* cpe:2.3:a:samba:samba:3.6.3:::::::* cpe:2.3:a:samba:samba:3.6.25:::::::* cpe:2.3:a:samba:samba:3.6.24:::::::* cpe:2.3:a:samba:samba:3.6.23:::::::* cpe:2.3:a:samba:samba:3.6.22:::::::* cpe:2.3:a:samba:samba:3.6.21:::::::* cpe:2.3:a:samba:samba:3.6.20:::::::* cpe:2.3:a:samba:samba:3.6.2:::::::* cpe:2.3:a:samba:samba:3.6.19:::::::* cpe:2.3:a:samba:samba:3.6.18:::::::* cpe:2.3:a:samba:samba:3.6.17:::::::* cpe:2.3:a:samba:samba:3.6.16:::::::* cpe:2.3:a:samba:samba:3.6.15:::::::* cpe:2.3:a:samba:samba:3.6.14:::::::* cpe:2.3:a:samba:samba:3.6.13:::::::* cpe:2.3:a:samba:samba:3.6.12:::::::* cpe:2.3:a:samba:samba:3.6.11:::::::* cpe:2.3:a:samba:samba:3.6.10:::::::* cpe:2.3:a:samba:samba:3.6.1:::::::* cpe:2.3:a:samba:samba:3.6.0:::::::* cpe:2.3:a:samba:samba:3.5.9:::::::* cpe:2.3:a:samba:samba:3.5.8:::::::* cpe:2.3:a:samba:samba:3.5.7:::::::* cpe:2.3:a:samba:samba:3.5.6:::::::* cpe:2.3:a:samba:samba:3.5.5:::::::* cpe:2.3:a:samba:samba:3.5.4:::::::* cpe:2.3:a:samba:samba:3.5.3:::::::* cpe:2.3:a:samba:samba:3.5.22:::::::* cpe:2.3:a:samba:samba:3.5.21:::::::* cpe:2.3:a:samba:samba:3.5.20:::::::* cpe:2.3:a:samba:samba:3.5.2:::::::* cpe:2.3:a:samba:samba:3.5.19:::::::* cpe:2.3:a:samba:samba:3.5.18:::::::* cpe:2.3:a:samba:samba:3.5.17:::::::* cpe:2.3:a:samba:samba:3.5.16:::::::* cpe:2.3:a:samba:samba:3.5.15:::::::* cpe:2.3:a:samba:samba:3.5.14:::::::* cpe:2.3:a:samba:samba:3.5.13:::::::* cpe:2.3:a:samba:samba:3.5.12:::::::* cpe:2.3:a:samba:samba:3.5.11:::::::* cpe:2.3:a:samba:samba:3.5.10:::::::* cpe:2.3:a:samba:samba:3.5.1:::::::* cpe:2.3:a:samba:samba:3.5.0:::::::* cpe:2.3:a:samba:samba:3.5:::::::* cpe:2.3:a:samba:samba:3.4.9:::::::* cpe:2.3:a:samba:samba:3.4.8:::::::* cpe:2.3:a:samba:samba:3.4.7:::::::* cpe:2.3:a:samba:samba:3.4.6:::::::* cpe:2.3:a:samba:samba:3.4.5:::::::* cpe:2.3:a:samba:samba:3.4.4:::::::* cpe:2.3:a:samba:samba:3.4.3:::::::* cpe:2.3:a:samba:samba:3.4.2:::::::* cpe:2.3:a:samba:samba:3.4.17:::::::* cpe:2.3:a:samba:samba:3.4.16:::::::* cpe:2.3:a:samba:samba:3.4.15:::::::* cpe:2.3:a:samba:samba:3.4.14:::::::* cpe:2.3:a:samba:samba:3.4.13:::::::* cpe:2.3:a:samba:samba:3.4.12:::::::* cpe:2.3:a:samba:samba:3.4.11:::::::* cpe:2.3:a:samba:samba:3.4.10:::::::* cpe:2.3:a:samba:samba:3.4.1:::::::* cpe:2.3:a:samba:samba:3.4.0:::::::* cpe:2.3:a:samba:samba:3.4:::::::* cpe:2.3:a:samba:samba:3.3.9:::::::* cpe:2.3:a:samba:samba:3.3.8:::::::* cpe:2.3:a:samba:samba:3.3.7:::::::* cpe:2.3:a:samba:samba:3.3.6:::::::* cpe:2.3:a:samba:samba:3.3.5:::::::* cpe:2.3:a:samba:samba:3.3.4:::::::* cpe:2.3:a:samba:samba:3.3.3:::::::* cpe:2.3:a:samba:samba:3.3.2:::::::* cpe:2.3:a:samba:samba:3.3.16:::::::* cpe:2.3:a:samba:samba:3.3.15:::::::* cpe:2.3:a:samba:samba:3.3.14:::::::* cpe:2.3:a:samba:samba:3.3.13:::::::* cpe:2.3:a:samba:samba:3.3.12:::::::* cpe:2.3:a:samba:samba:3.3.11:::::::* cpe:2.3:a:samba:samba:3.3.10:::::::* cpe:2.3:a:samba:samba:3.3.1:::::::* cpe:2.3:a:samba:samba:3.3.0:::::::* cpe:2.3:a:samba:samba:3.3:::::::* cpe:2.3:a:samba:samba:3.2.9:::::::* cpe:2.3:a:samba:samba:3.2.8:::::::* cpe:2.3:a:samba:samba:3.2.7:::::::* cpe:2.3:a:samba:samba:3.2.6:::::::* cpe:2.3:a:samba:samba:3.2.5:::::::* cpe:2.3:a:samba:samba:3.2.4:::::::* cpe:2.3:a:samba:samba:3.2.3:::::::* cpe:2.3:a:samba:samba:3.2.2:::::::* cpe:2.3:a:samba:samba:3.2.15:::::::* cpe:2.3:a:samba:samba:3.2.14:::::::* cpe:2.3:a:samba:samba:3.2.13:::::::* cpe:2.3:a:samba:samba:3.2.12:::::::* cpe:2.3:a:samba:samba:3.2.11:::::::* cpe:2.3:a:samba:samba:3.2.10:::::::* cpe:2.3:a:samba:samba:3.2.1:::::::* cpe:2.3:a:samba:samba:3.2.0:::::::* cpe:2.3:a:samba:samba:3.2:::::::* cpe:2.3:a:samba:samba:3.1.0:::::::* cpe:2.3:a:samba:samba:3.0.9:::::::* cpe:2.3:a:samba:samba:3.0.8:::::::* cpe:2.3:a:samba:samba:3.0.7:::::::* cpe:2.3:a:samba:samba:3.0.6:::::::* cpe:2.3:a:samba:samba:3.0.5:::::::* cpe:2.3:a:samba:samba:3.0.4:rc1:::::: cpe:2.3:a:samba:samba:3.0.4:-:::::: cpe:2.3:a:samba:samba:3.0.37:::::::* cpe:2.3:a:samba:samba:3.0.36:::::::* cpe:2.3:a:samba:samba:3.0.35:::::::* cpe:2.3:a:samba:samba:3.0.34:::::::* cpe:2.3:a:samba:samba:3.0.33:::::::* cpe:2.3:a:samba:samba:3.0.32:::::::* cpe:2.3:a:samba:samba:3.0.31:::::::* cpe:2.3:a:samba:samba:3.0.30:::::::* cpe:2.3:a:samba:samba:3.0.3:::::::* cpe:2.3:a:samba:samba:3.0.2a:::::::* cpe:2.3:a:samba:samba:3.0.29:::::::* cpe:2.3:a:samba:samba:3.0.28a:::::::* cpe:2.3:a:samba:samba:3.0.28:-:::::: cpe:2.3:a:samba:samba:3.0.28:a:::::: cpe:2.3:a:samba:samba:3.0.27a:::::::* cpe:2.3:a:samba:samba:3.0.27:-:::::: cpe:2.3:a:samba:samba:3.0.27:a:::::: cpe:2.3:a:samba:samba:3.0.26a:::::::* cpe:2.3:a:samba:samba:3.0.26:a:::::: cpe:2.3:a:samba:samba:3.0.26:-:::::: cpe:2.3:a:samba:samba:3.0.25c:::::::* cpe:2.3:a:samba:samba:3.0.25b:::::::* cpe:2.3:a:samba:samba:3.0.25a:::::::* cpe:2.3:a:samba:samba:3.0.25:rc2:::::: cpe:2.3:a:samba:samba:3.0.25:rc3:::::: cpe:2.3:a:samba:samba:3.0.25:pre1:::::: cpe:2.3:a:samba:samba:3.0.25:rc1:::::: cpe:2.3:a:samba:samba:3.0.25:-:::::: cpe:2.3:a:samba:samba:3.0.25:a:::::: cpe:2.3:a:samba:samba:3.0.25:pre2:::::: cpe:2.3:a:samba:samba:3.0.25:c:::::: cpe:2.3:a:samba:samba:3.0.25:b:::::: cpe:2.3:a:samba:samba:3.0.24:::::::* cpe:2.3:a:samba:samba:3.0.23d:::::::* cpe:2.3:a:samba:samba:3.0.23c:::::::* cpe:2.3:a:samba:samba:3.0.23b:::::::* cpe:2.3:a:samba:samba:3.0.23a:::::::* cpe:2.3:a:samba:samba:3.0.23:-:::::: cpe:2.3:a:samba:samba:3.0.23:a:::::: cpe:2.3:a:samba:samba:3.0.23:d:::::: cpe:2.3:a:samba:samba:3.0.23:c:::::: cpe:2.3:a:samba:samba:3.0.23:b:::::: cpe:2.3:a:samba:samba:3.0.22:::::::* cpe:2.3:a:samba:samba:3.0.21c:::::::* cpe:2.3:a:samba:samba:3.0.21b:::::::* cpe:2.3:a:samba:samba:3.0.21a:::::::* cpe:2.3:a:samba:samba:3.0.21:-:::::: cpe:2.3:a:samba:samba:3.0.21:a:::::: cpe:2.3:a:samba:samba:3.0.21:c:::::: cpe:2.3:a:samba:samba:3.0.21:b:::::: cpe:2.3:a:samba:samba:3.0.20b:::::::* cpe:2.3:a:samba:samba:3.0.20a:::::::* cpe:2.3:a:samba:samba:3.0.20:b:::::: cpe:2.3:a:samba:samba:3.0.20:-:::::: cpe:2.3:a:samba:samba:3.0.20:a:::::: cpe:2.3:a:samba:samba:3.0.2:a:::::: cpe:2.3:a:samba:samba:3.0.2:-:::::: cpe:2.3:a:samba:samba:3.0.19:::::::* cpe:2.3:a:samba:samba:3.0.18:::::::* cpe:2.3:a:samba:samba:3.0.17:::::::* cpe:2.3:a:samba:samba:3.0.16:::::::* cpe:2.3:a:samba:samba:3.0.15:::::::* cpe:2.3:a:samba:samba:3.0.14a:::::::* cpe:2.3:a:samba:samba:3.0.14:-:::::: cpe:2.3:a:samba:samba:3.0.14:a:::::: cpe:2.3:a:samba:samba:3.0.13:::::::* cpe:2.3:a:samba:samba:3.0.12:::::::* cpe:2.3:a:samba:samba:3.0.11:::::::* cpe:2.3:a:samba:samba:3.0.10:::::::* cpe:2.3:a:samba:samba:3.0.1:::::::* cpe:2.3:a:samba:samba:3.0.0:::::::* cpe:2.3:a:samba:samba:2.2a:::::::* cpe:2.3:a:samba:samba:2.2.9:::::::* cpe:2.3:a:samba:samba:2.2.8a:::::::* cpe:2.3:a:samba:samba:2.2.8:-:::::: cpe:2.3:a:samba:samba:2.2.8:a:::::: cpe:2.3:a:samba:samba:2.2.7a:::::::* cpe:2.3:a:samba:samba:2.2.7:-:::::: cpe:2.3:a:samba:samba:2.2.7:a:::::: cpe:2.3:a:samba:samba:2.2.6:::::::* cpe:2.3:a:samba:samba:2.2.5:::::::* cpe:2.3:a:samba:samba:2.2.4:::::::* cpe:2.3:a:samba:samba:2.2.3a:::::::* cpe:2.3:a:samba:samba:2.2.3:-:::::: cpe:2.3:a:samba:samba:2.2.3:a:::::: cpe:2.3:a:samba:samba:2.2.2:::::::* cpe:2.3:a:samba:samba:2.2.1a:::::::* cpe:2.3:a:samba:samba:2.2.12:::::::* cpe:2.3:a:samba:samba:2.2.11:::::::* cpe:2.3:a:samba:samba:2.2.10:::::::* cpe:2.3:a:samba:samba:2.2.1:-:::::: cpe:2.3:a:samba:samba:2.2.1:a:::::: cpe:2.3:a:samba:samba:2.2.0a:::::::* cpe:2.3:a:samba:samba:2.2.0:-:::::: cpe:2.3:a:samba:samba:2.2.0:a:::::: cpe:2.3:a:samba:samba:2.2:a:::::: cpe:2.3:a:samba:samba:2.18.3:::::::* cpe:2.3:a:samba:samba:2.0.9:::::::* cpe:2.3:a:samba:samba:2.0.8:::::::* cpe:2.3:a:samba:samba:2.0.7:::::::* cpe:2.3:a:samba:samba:2.0.6:::::::* cpe:2.3:a:samba:samba:2.0.5a:::::::* cpe:2.3:a:samba:samba:2.0.5:-:::::: cpe:2.3:a:samba:samba:2.0.5:a:::::: cpe:2.3:a:samba:samba:2.0.4:::::::* cpe:2.3:a:samba:samba:2.0.3:::::::* cpe:2.3:a:samba:samba:2.0.2:::::::* cpe:2.3:a:samba:samba:2.0.10:::::::* cpe:2.3:a:samba:samba:2.0.1:::::::* cpe:2.3:a:samba:samba:2.0.0:::::::* cpe:2.3:a:samba:samba:2.0:::::::* cpe:2.3:a:samba:samba:1.9.18:p10:::::: cpe:2.3:a:samba:samba:1.9.18:p6:::::: cpe:2.3:a:samba:samba:1.9.18:p8:::::: cpe:2.3:a:samba:samba:1.9.18:p1:::::: cpe:2.3:a:samba:samba:1.9.18:p4:::::: cpe:2.3:a:samba:samba:1.9.18:p2:::::: cpe:2.3:a:samba:samba:1.9.18:p3:::::: cpe:2.3:a:samba:samba:1.9.18:p7:::::: cpe:2.3:a:samba:samba:1.9.18:p5:::::: cpe:2.3:a:samba:samba:1.9.18:-:::::: cpe:2.3:a:samba:samba:1.9.17:p4:::::: cpe:2.3:a:samba:samba:1.9.17:p1:::::: cpe:2.3:a:samba:samba:1.9.17:p5:::::: cpe:2.3:a:samba:samba:1.9.17:::::::* cpe:2.3:a:samba:samba:1.9.17:p2:::::: cpe:2.3:a:samba:samba:1.9.17:p3:::::: cpe:2.3:a:samba:samba:::::::: cpe:2.3:a:samba:samba:-:::::::*	271
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:13.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:12.04::::-::: cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::	5
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:7.0:::::::* cpe:2.3:o:debian:debian_linux:6.0:::::::*	2

Information Assurance Vulnerability Management (IAVM)

Date	Description
2013-11-14	IAVM : 2013-B-0131 - Multiple Vulnerabilities in Samba Severity : Category I - VMSKEY : V0042303

Nessus® Vulnerability Scanner

Date	Description
2016-04-21	Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-490.nasl - Type : ACT_GATHER_INFO
2015-05-20	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-0839-1.nasl - Type : ACT_GATHER_INFO
2015-05-20	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-0723-1.nasl - Type : ACT_GATHER_INFO
2015-02-26	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201502-15.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_samba_20140225.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_samba_20140114.nasl - Type : ACT_GATHER_INFO
2014-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0009.nasl - Type : ACT_GATHER_INFO
2014-08-20	Name : The remote Fedora host is missing a security update. File : fedora_2014-9132.nasl - Type : ACT_GATHER_INFO
2014-06-26	Name : The remote Fedora host is missing a security update. File : fedora_2014-7672.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-996.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-881.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-910.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-229.nasl - Type : ACT_GATHER_INFO
2014-04-11	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0383.nasl - Type : ACT_GATHER_INFO
2014-04-10	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140409_samba4_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-04-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0383.nasl - Type : ACT_GATHER_INFO
2014-04-10	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0383.nasl - Type : ACT_GATHER_INFO
2014-03-26	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140325_samba_and_samba3x_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-03-26	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0330.nasl - Type : ACT_GATHER_INFO
2014-03-26	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0330.nasl - Type : ACT_GATHER_INFO
2014-03-26	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0330.nasl - Type : ACT_GATHER_INFO
2014-01-14	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-013-04.nasl - Type : ACT_GATHER_INFO
2014-01-07	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_cifs-mount-131213.nasl - Type : ACT_GATHER_INFO
2013-12-24	Name : The remote Fedora host is missing a security update. File : fedora_2013-23177.nasl - Type : ACT_GATHER_INFO
2013-12-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-299.nasl - Type : ACT_GATHER_INFO
2013-12-16	Name : The remote Fedora host is missing a security update. File : fedora_2013-23085.nasl - Type : ACT_GATHER_INFO
2013-12-12	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2054-1.nasl - Type : ACT_GATHER_INFO
2013-12-12	Name : The remote Samba server is affected by multiple vulnerabilities. File : samba_4_1_3.nasl - Type : ACT_GATHER_INFO
2013-12-11	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131210_samba_and_samba3x_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-12-11	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131210_samba4_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-1805.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2812.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_613e45d1615411e39b62000c292e4fd8.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-1806.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-1806.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1805.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1806.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-1805.nasl - Type : ACT_GATHER_INFO
2013-11-26	Name : The remote Fedora host is missing a security update. File : fedora_2013-21088.nasl - Type : ACT_GATHER_INFO
2013-11-25	Name : The remote Fedora host is missing a security update. File : fedora_2013-21207.nasl - Type : ACT_GATHER_INFO
2013-11-22	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-278.nasl - Type : ACT_GATHER_INFO
2013-11-21	Name : The remote Fedora host is missing a security update. File : fedora_2013-21094.nasl - Type : ACT_GATHER_INFO
2013-11-20	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_a4f08579516c11e39b62000c292e4fd8.nasl - Type : ACT_GATHER_INFO
2013-11-19	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-322-03.nasl - Type : ACT_GATHER_INFO
2013-11-15	Name : The remote Samba server is affected by multiple vulnerabilities. File : samba_4_1_1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 12:02:52	Multiple Updates
2013-12-12 00:22:12	Multiple Updates
2013-12-11 17:18:04	First insertion

Global Informations

Type	Count
CWE ID(s)	3
Oval ID(s)	14
CPE ID(s)	278
IAVM(s)	1
Nessus® Exploit(s)	45

	Related
8.3	CVE-2013-4408
4	CVE-2013-4475
3.6	CVE-2012-6150
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)

8.3 - USN-2054-1

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Information Assurance Vulnerability Management (IAVM)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU