3.5 - CVE-2010-0926

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2010-0926	First vendor Publication	2010-03-10
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:P/I:N/A:N)
Cvss Base Score	3.5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	6.8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0926

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13096

Oval ID:	oval:org.mitre.oval:def:13096
Title:	USN-918-1 -- samba vulnerability
Description:	It was discovered the Samba handled symlinks in an unexpected way when both "wide links" and "UNIX extensions" were enabled, which is the default. A remote attacker could create symlinks and access arbitrary files from the server.
Family:	unix	Class:	patch
Reference(s):	USN-918-1 CVE-2010-0926	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 8.10 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04	Product(s):	samba
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section samba-doc DPKG is earlier than 3.0.28a-1ubuntu4.11 AND samba-doc-pdf DPKG is earlier than 3.0.28a-1ubuntu4.11 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section smbfs DPKG is earlier than 3.0.28a-1ubuntu4.11 AND samba DPKG is earlier than 3.0.28a-1ubuntu4.11 AND swat DPKG is earlier than 3.0.28a-1ubuntu4.11 AND libsmbclient DPKG is earlier than 3.0.28a-1ubuntu4.11 AND smbclient DPKG is earlier than 3.0.28a-1ubuntu4.11 AND winbind DPKG is earlier than 3.0.28a-1ubuntu4.11 AND libpam-smbpass DPKG is earlier than 3.0.28a-1ubuntu4.11 AND libsmbclient-dev DPKG is earlier than 3.0.28a-1ubuntu4.11 AND samba-common DPKG is earlier than 3.0.28a-1ubuntu4.11 AND samba-dbg DPKG is earlier than 3.0.28a-1ubuntu4.11 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section samba-doc DPKG is earlier than 3.2.3-1ubuntu3.8 AND samba-doc-pdf DPKG is earlier than 3.2.3-1ubuntu3.8 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section smbfs DPKG is earlier than 3.2.3-1ubuntu3.8 AND samba DPKG is earlier than 3.2.3-1ubuntu3.8 AND swat DPKG is earlier than 3.2.3-1ubuntu3.8 AND samba-tools DPKG is earlier than 3.2.3-1ubuntu3.8 AND libsmbclient DPKG is earlier than 3.2.3-1ubuntu3.8 AND smbclient DPKG is earlier than 3.2.3-1ubuntu3.8 AND winbind DPKG is earlier than 3.2.3-1ubuntu3.8 AND libwbclient0 DPKG is earlier than 3.2.3-1ubuntu3.8 AND libpam-smbpass DPKG is earlier than 3.2.3-1ubuntu3.8 AND libsmbclient-dev DPKG is earlier than 3.2.3-1ubuntu3.8 AND samba-common DPKG is earlier than 3.2.3-1ubuntu3.8 AND samba-dbg DPKG is earlier than 3.2.3-1ubuntu3.8 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section samba-common DPKG is earlier than 3.4.0-3ubuntu5.6 AND samba-doc DPKG is earlier than 3.4.0-3ubuntu5.6 AND samba-doc-pdf DPKG is earlier than 3.4.0-3ubuntu5.6 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section smbfs DPKG is earlier than 3.4.0-3ubuntu5.6 AND samba DPKG is earlier than 3.4.0-3ubuntu5.6 AND swat DPKG is earlier than 3.4.0-3ubuntu5.6 AND samba-tools DPKG is earlier than 3.4.0-3ubuntu5.6 AND libsmbclient DPKG is earlier than 3.4.0-3ubuntu5.6 AND smbclient DPKG is earlier than 3.4.0-3ubuntu5.6 AND winbind DPKG is earlier than 3.4.0-3ubuntu5.6 AND samba-common-bin DPKG is earlier than 3.4.0-3ubuntu5.6 AND libwbclient0 DPKG is earlier than 3.4.0-3ubuntu5.6 AND libpam-smbpass DPKG is earlier than 3.4.0-3ubuntu5.6 AND libsmbclient-dev DPKG is earlier than 3.4.0-3ubuntu5.6 AND samba-dbg DPKG is earlier than 3.4.0-3ubuntu5.6 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section samba-doc DPKG is earlier than 3.0.22-1ubuntu3.11 AND samba-doc-pdf DPKG is earlier than 3.0.22-1ubuntu3.11 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section smbfs DPKG is earlier than 3.0.22-1ubuntu3.11 AND samba DPKG is earlier than 3.0.22-1ubuntu3.11 AND swat DPKG is earlier than 3.0.22-1ubuntu3.11 AND libsmbclient DPKG is earlier than 3.0.22-1ubuntu3.11 AND smbclient DPKG is earlier than 3.0.22-1ubuntu3.11 AND winbind DPKG is earlier than 3.0.22-1ubuntu3.11 AND libpam-smbpass DPKG is earlier than 3.0.22-1ubuntu3.11 AND libsmbclient-dev DPKG is earlier than 3.0.22-1ubuntu3.11 AND samba-common DPKG is earlier than 3.0.22-1ubuntu3.11 AND python2.4-samba DPKG is earlier than 3.0.22-1ubuntu3.11 AND samba-dbg DPKG is earlier than 3.0.22-1ubuntu3.11 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section samba-doc DPKG is earlier than 3.3.2-1ubuntu3.4 AND samba-doc-pdf DPKG is earlier than 3.3.2-1ubuntu3.4 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section smbfs DPKG is earlier than 3.3.2-1ubuntu3.4 AND samba DPKG is earlier than 3.3.2-1ubuntu3.4 AND swat DPKG is earlier than 3.3.2-1ubuntu3.4 AND samba-tools DPKG is earlier than 3.3.2-1ubuntu3.4 AND libsmbclient DPKG is earlier than 3.3.2-1ubuntu3.4 AND smbclient DPKG is earlier than 3.3.2-1ubuntu3.4 AND winbind DPKG is earlier than 3.3.2-1ubuntu3.4 AND libwbclient0 DPKG is earlier than 3.3.2-1ubuntu3.4 AND libpam-smbpass DPKG is earlier than 3.3.2-1ubuntu3.4 AND libsmbclient-dev DPKG is earlier than 3.3.2-1ubuntu3.4 AND samba-common DPKG is earlier than 3.3.2-1ubuntu3.4 AND samba-dbg DPKG is earlier than 3.3.2-1ubuntu3.4

Definition Id: oval:org.mitre.oval:def:20961

Oval ID:	oval:org.mitre.oval:def:20961
Title:	RHSA-2012:0313: samba security, bug fix, and enhancement update (Low)
Description:	The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.
Family:	unix	Class:	patch
Reference(s):	RHSA-2012:0313-03 CVE-2010-0926	Version:	4
Platform(s):	Red Hat Enterprise Linux 5	Product(s):	samba
Definition Synopsis:
The operating system installed on the system is Red Hat Enterprise Linux 5 Packages section libsmbclient is earlier than 0:3.0.33-3.37.el5 AND samba is earlier than 0:3.0.33-3.37.el5 AND samba-swat is earlier than 0:3.0.33-3.37.el5 AND samba-client is earlier than 0:3.0.33-3.37.el5 AND samba-common is earlier than 0:3.0.33-3.37.el5 AND libsmbclient-devel is earlier than 0:3.0.33-3.37.el5

Definition Id: oval:org.mitre.oval:def:23240

Oval ID:	oval:org.mitre.oval:def:23240
Title:	ELSA-2012:0313: samba security, bug fix, and enhancement update (Low)
Description:	The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:0313-03 CVE-2010-0926	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	samba
Definition Synopsis:
Oracle Linux 5.x rpm test libsmbclient is earlier than 0:3.0.33-3.37.el5 AND samba is earlier than 0:3.0.33-3.37.el5 AND samba-swat is earlier than 0:3.0.33-3.37.el5 AND samba-client is earlier than 0:3.0.33-3.37.el5 AND samba-common is earlier than 0:3.0.33-3.37.el5 AND libsmbclient-devel is earlier than 0:3.0.33-3.37.el5

Definition Id: oval:org.mitre.oval:def:27882

Oval ID:	oval:org.mitre.oval:def:27882
Title:	DEPRECATED: ELSA-2012-0313 -- samba security, bug fix, and enhancement update (low)
Description:	[3.0.33-3.37.el5] - Regenerate manpage for 'wide links' and 'unix extensions' sections - related: #722553 [3.0.33-3.36.el5] - Security Release, fixes CVE-2010-0926 - resolves: #722553 [3.0.33-3.35.el5] - Fix smbclient return code - resolves: #768908 [3.0.33-3.34.el5] - Fix support for Windows 2008 R2 domains - resolves: #736124 [3.0.33-3.33.el5] - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694, CVE-2011-2522, CVE-2011-1678, CVE-2011-2724 - resolves: #722553 [3.0.33-3.32.el5] - Security Release, fixes CVE-2011-0719 - resolves: #678331 [3.0.33-3.30.el5] - Security Release, fixes CVE-2010-3069 - resolves: #632230
Family:	unix	Class:	patch
Reference(s):	ELSA-2012-0313 CVE-2010-0926	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	samba
Definition Synopsis:
Oracle Linux 5.x Packages match section samba is earlier than 0:3.0.33-3.37.el5 AND libsmbclient is earlier than 0:3.0.33-3.37.el5 AND libsmbclient-devel is earlier than 0:3.0.33-3.37.el5 AND samba-client is earlier than 0:3.0.33-3.37.el5 AND samba-common is earlier than 0:3.0.33-3.37.el5 AND samba-swat is earlier than 0:3.0.33-3.37.el5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Samba cpe:2.3:a:samba:samba:3.5.0:::::::* cpe:2.3:a:samba:samba:3.4.5:::::::* cpe:2.3:a:samba:samba:3.4.4:::::::* cpe:2.3:a:samba:samba:3.4.3:::::::* cpe:2.3:a:samba:samba:3.4.2:::::::* cpe:2.3:a:samba:samba:3.4.1:::::::* cpe:2.3:a:samba:samba:3.4.0:::::::* cpe:2.3:a:samba:samba:3.3.9:::::::* cpe:2.3:a:samba:samba:3.3.8:::::::* cpe:2.3:a:samba:samba:3.3.7:::::::* cpe:2.3:a:samba:samba:3.3.6:::::::* cpe:2.3:a:samba:samba:3.3.5:::::::* cpe:2.3:a:samba:samba:3.3.4:::::::* cpe:2.3:a:samba:samba:3.3.3:::::::* cpe:2.3:a:samba:samba:3.3.2:::::::* cpe:2.3:a:samba:samba:3.3.10:::::::* cpe:2.3:a:samba:samba:3.3.1:::::::* cpe:2.3:a:samba:samba:3.3.0:::::::*	18

OpenVAS Exploits

Date	Description
2012-02-21	Name : RedHat Update for samba RHSA-2012:0313-03 File : nvt/gb_RHSA-2012_0313-03_samba.nasl
2010-03-31	Name : Ubuntu Update for samba vulnerability USN-918-1 File : nvt/gb_ubuntu_USN_918_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
62145	Samba Guest Account Symlink Traversal Arbitrary File Access

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0313.nasl - Type : ACT_GATHER_INFO
2012-02-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0313.nasl - Type : ACT_GATHER_INFO
2010-10-11	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_cifs-mount-6921.nasl - Type : ACT_GATHER_INFO
2010-04-09	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12595.nasl - Type : ACT_GATHER_INFO
2010-04-09	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_cifs-mount-6920.nasl - Type : ACT_GATHER_INFO
2010-03-25	Name : The remote openSUSE host is missing a security update. File : suse_11_0_cifs-mount-100312.nasl - Type : ACT_GATHER_INFO
2010-03-25	Name : The remote openSUSE host is missing a security update. File : suse_11_1_cifs-mount-100312.nasl - Type : ACT_GATHER_INFO
2010-03-25	Name : The remote openSUSE host is missing a security update. File : suse_11_2_cifs-mount-100315.nasl - Type : ACT_GATHER_INFO
2010-03-25	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-918-1.nasl - Type : ACT_GATHER_INFO
2010-03-23	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_cifs-mount-100312.nasl - Type : ACT_GATHER_INFO
2010-02-08	Name : The remote file server is prone to a symlink attack. File : samba_symlink_dir_traversal.nasl - Type : ACT_DESTRUCTIVE_ATTACK

Sources (Detail)

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 23:09:15	Multiple Updates
2024-11-28 12:21:24	Multiple Updates
2023-11-07 21:47:37	Multiple Updates
2021-05-04 12:11:18	Multiple Updates
2021-04-22 01:11:50	Multiple Updates
2020-05-23 00:25:26	Multiple Updates
2016-04-26 19:38:55	Multiple Updates
2014-02-17 10:54:18	Multiple Updates
2013-05-10 23:20:16	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	4
CPE ID(s)	18
Sources(s)	35
osvdb(s)	1
Openvas Exploit(s)	2
Nessus® Exploit(s)	11

	Related
3.5	RHSA-2012:0313
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)