CVSS: 3.5EPSS: 0%CPEs: 29EXPL: 0CVE-2014-0178 – samba: Uninitialized memory exposure
https://notcve.org/view.php?id=CVE-2014-0178
Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request. Samba 3.6.6 hasta 3.6.23, 4.0.x anterior a 4.0.18 y 4.1.x anterior a 4.1.8, cuando cierta configuración de copia shadow vfs está habilitada, no inicializa debidamente el campo de respuesta SRV_SNAPSHOT_ARRAY, lo que permite a usuarios remotos autenticados obtener información potencialmente sensible de la memoria de procesos a través de una solicitud (1) FSCTL_GET_SHADOW_COPY_DATA o (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS. A flaw was found in the way Samba created responses for certain authenticated client requests when a shadow-copy VFS module was enabled. An attacker able to send an authenticated request could use this flaw to disclose limited portions of memory per each request. • http://advisories.mageia.org/MGASA-2014-0279.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html http://secunia.com/advisories/59378 http://secunia.com/advisories/59407 http://secunia.com/advisories/59579 http://security.gentoo.org/glsa/glsa-201502-15.xml http://www.mandriva.com/security/advisories?name=MDVSA-2014:136 http://www.mandriva.com/security/advisories?name=MDVSA-2015:08 • CWE-201: Insertion of Sensitive Information Into Sent Data CWE-665: Improper Initialization •
CVSS: 5.0EPSS: 37%CPEs: 2EXPL: 0CVE-2014-0239
https://notcve.org/view.php?id=CVE-2014-0239
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103. El servidor DNS interno en Samba 4.x anterior a 4.0.18 no comprueba el campo QR en la sección de cabecera de un mensaje DNS entrante antes de enviar una respuesta, lo que permite a atacantes remotos causar una denegación de servicio (consumo de CPU y ancho de banda) a través de un paquete de respuestas falsificado que provoca un bucle de comunicación, un problema relacionado con CVE-1999-0103. • http://secunia.com/advisories/59579 http://security.gentoo.org/glsa/glsa-201502-15.xml http://www.samba.org/samba/security/CVE-2014-0239 http://www.securityfocus.com/bid/67691 http://www.securitytracker.com/id/1030309 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2013-4496 – samba: Password lockout not enforced for SAMR password changes
https://notcve.org/view.php?id=CVE-2013-4496
Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts. Samba 3.x anterior a 3.6.23, 4.0.x anterior a 4.0.16 y 4.1.x anterior a 4.1.6 no fuerza el mecanismo de protección de adivinación de contraseña para todas las interfaces, lo que facilita a atacantes remotos obtener acceso a través de intentos de fuerza bruta de ChangePasswordUser2 (1) SAMR o (2) RAP. • http://advisories.mageia.org/MGASA-2014-0138.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00062.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00063.html http://rhn. • CWE-255: Credentials Management Errors •
CVSS: 5.8EPSS: 0%CPEs: 22EXPL: 0CVE-2013-6442 – samba: smbcacls will delete ACL lists in certain circumstances
https://notcve.org/view.php?id=CVE-2013-6442
The owner_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4.1.6 removes an ACL during use of a --chown or --chgrp option, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended administrative change. La función owner_set en smbcacls.c en smbcacls en Samba 4.0.x anterior a 4.0.16 y 4.1.x anterior a 4.1.6 elimina una ACL durante el uso de una opción de --chown o --chgrp, lo que permite a atacantes remotos evadir restricciones de acceso en circunstancias oportunistas mediante el aprovechamiento de un cambio de administrativo no intencionado. • http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00062.html http://www.samba.org/samba/history/samba-4.0.16.html http://www.samba.org/samba/history/samba-4.1.6.html http://www.samba.org/samba/security/CVE-2013-6442 http://www.securityfocus.com/bid/66232 https://bugzilla.samba.org/show_bug.cgi?id=10327 https:/ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.3EPSS: 0%CPEs: 188EXPL: 0CVE-2013-4408 – samba: Heap-based buffer overflow due to incorrect DCE-RPC fragment length field check
https://notcve.org/view.php?id=CVE-2013-4408
Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet. Desbordamiento de búfer en la función dcerpc_read_ncacn_packet_done en librpc/rpc/dcerpc_util.c en winbindd en Samba 3.x anterior a 3.6.22, 4.0.x anterior a 4.0.13 y 4.1.x anterior a 4.1.3 que permite a los controladores de dominio de AD remotos ejecutar código arbitrario a través de una longitud erroenea de los fragmentos de un paquete de DCE-RPC. • http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00063. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •