CVSS: 5.1EPSS: 1%CPEs: 163EXPL: 0CVE-2013-0214 – samba: cross-site request forgery vulnerability in SWAT
https://notcve.org/view.php?id=CVE-2013-0214
Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el Samba Web Administration Tool (SWAT)en Samba v3.x anterior a v3.5.21, v3.6.x anterior a v3.6.12, y v4.x anterior a v4.0.2, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección para aprovecharse de la contraseña y hacer peticiones que lleven a cabo acciones SWAT • http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00042.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00029.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00033.html http://osvdb.org/89627 http://rhn.redhat.com/errata/RHSA-2013-1310.html http://rhn.redhat.com/errata/RHSA-2013-1542.html http://rhn.redhat.com/errata/RHSA-2014-0305.html http://www.debian.org/security&# • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 37EXPL: 0CVE-2012-2111 – samba: Incorrect permission checks when granting/removing privileges
https://notcve.org/view.php?id=CVE-2012-2111
The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection. El (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, y (4) RemoveAccountRights LSA RPC procedimientos en smbd de Samba v3.4.x anterior a v3.4.17, v3.5.x anterior a v3.5.15 y v3.6.x anterior a v3.6.5 no restringe correctamente las modificaciones en la base de datos de privilegios, permitiendo a usuarios remotos autenticados obtener la "toma de posesión" de privilegios a través de una conexión LSA. • http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079662.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079670.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079677.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00003.html http://marc.info/?l=bugtraq&m=134323086902585&w • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 75%CPEs: 144EXPL: 1CVE-2012-1182 – Samba ReportEventW Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1182
The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. El generador de código RPC de Samba 3.x anteriores a 3.4.16, 3.5.x anteriores a 3.5.14, y 3.6.x anteriores a 3.6.4 no implementa la validación de una longitud de array de una manera consistente con la validación de la reserva de memoria del array, lo que permite a atacantes remotos ejecutar código arbitrario a través de una llamada RPC modificada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samba. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way Samba handles ReportEventW requests. When parsing the data send in the request Samba uses the field 'strings' to create a heap allocation but then uses another field, 'num_of_strings', to write data to the allocation. • https://www.exploit-db.com/exploits/21850 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078258.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078726.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078836.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080567.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00007.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 3%CPEs: 3EXPL: 0CVE-2012-0817
https://notcve.org/view.php?id=CVE-2012-0817
Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests. Fallo de memoria en smbd en Samba v3.6.x anterior a 3.6.3 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y CPU)realizando numerosas peticiones de conexión. • http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072930.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00014.html http://secunia.com/advisories/47763 http://secunia.com/advisories/48879 http://www.samba.org/samba/history/samba-3.6.3.html http://www.samba.org/samba/security/CVE-2012-0817 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •