CVSS: 10.0EPSS: 75%CPEs: 144EXPL: 1CVE-2012-1182 – Samba ReportEventW Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1182
10 Apr 2012 — The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. El generador de código RPC de Samba 3.x anteriores a 3.4.16, 3.5.x anteriores a 3.5.14, y 3.6.x anteriores a 3.6.4 no implementa la validación de una longitud de array de una manera consistente con la validación de la res... • https://www.exploit-db.com/exploits/21850 • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 30%CPEs: 12EXPL: 0CVE-2012-0870 – samba: Any Batched ("AndX") request processing infinite recursion and heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2012-0870
23 Feb 2012 — Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion. Un desbordamiento de buffer basado en memoria dinámica (heap) en process.c de smbd en Samba v3.0, tal como se utiliza en el servicio de intercambio de archivos en la tablet... • http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB29565 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 2%CPEs: 3EXPL: 0CVE-2012-0817
https://notcve.org/view.php?id=CVE-2012-0817
30 Jan 2012 — Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests. Fallo de memoria en smbd en Samba v3.6.x anterior a 3.6.3 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y CPU)realizando numerosas peticiones de conexión. • http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072930.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 192EXPL: 0CVE-2011-2724 – cifs-utils: mount.cifs incorrect fix for CVE-2010-0547
https://notcve.org/view.php?id=CVE-2011-2724
06 Sep 2011 — The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547. La función check_mtab en client/mount.cifs.c en mount.cifs en smbfs en Samba v3.5.10 y anteriores no verifica correctamente que el... • http://comments.gmane.org/gmane.linux.kernel.cifs/3827 • CWE-20: Improper Input Validation •
CVSS: 4.8EPSS: 3%CPEs: 10EXPL: 0CVE-2011-2694 – (SWAT): XSS flaw in Change Password page
https://notcve.org/view.php?id=CVE-2011-2694
29 Jul 2011 — Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page). Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la función chg_passwd en web/swat.c en la herramienta de administración web de Samba (SWAT) en Samba v3.x ante... • http://jvn.jp/en/jp/JVN63041502/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 21%CPEs: 10EXPL: 2CVE-2011-2522 – SWAT Samba Web Administration Tool - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2011-2522
29 Jul 2011 — Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program. Varias vulnerabilidades de falsificación... • https://www.exploit-db.com/exploits/17577 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2011-1678 – samba/cifs-utils: mount.cifs and umount.cifs fail to anticipate RLIMIT_FSIZE
https://notcve.org/view.php?id=CVE-2011-1678
10 Apr 2011 — smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089. smbfs en Samba v3.5.8 y anteriores, un intento de utilizar (1) mount.cifs para añadir al fichero /etc/mtab y (2) umount.cifs para añadir al ficher... • http://openwall.com/lists/oss-security/2011/03/04/10 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 18%CPEs: 127EXPL: 0CVE-2011-0719 – Samba unsafe fd_set usage
https://notcve.org/view.php?id=CVE-2011-0719
01 Mar 2011 — Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd. Samba versión 3.x anterior a 3.3.15, versión 3.4.x anterior a 3.4.12 y versión 3.5.x anterior a 3.5.7, no realiza comprobaciones de rango para los descriptores de archi... • http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 37%CPEs: 8EXPL: 0CVE-2010-3069 – Samba: Stack-based buffer overflow by processing specially-crafted SID records
https://notcve.org/view.php?id=CVE-2010-3069
15 Sep 2010 — Stack-based buffer overflow in the (1) sid_parse and (2) dom_sid_parse functions in Samba before 3.5.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Windows Security ID (SID) on a file share. Un desbordamiento de búfer basado en pila en las funciones (1) sid_parse y (2) dom_sid_parse en Samba anterior a v3.5.5 permite a los atacantes remotos causar una denegación de servicio (caída) y posiblemente ejecutar código a su elección a través de Wind... • http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 7.5EPSS: 6%CPEs: 104EXPL: 1CVE-2010-1635
https://notcve.org/view.php?id=CVE-2010-1635
17 Jun 2010 — The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value. La función chain_reply de process.c de smbd de Samba anterior a v3.4.8, y v3.5.x anterior a v3.5.2 permite a atacantes remotos provocar una denegación de servicio (referencia a pun... • http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=25452a2268ac7013da28125f3df22085139af12d •