CVSS: 6.5EPSS: 0%CPEs: 37EXPL: 0CVE-2012-2111 – samba: Incorrect permission checks when granting/removing privileges
https://notcve.org/view.php?id=CVE-2012-2111
The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection. El (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, y (4) RemoveAccountRights LSA RPC procedimientos en smbd de Samba v3.4.x anterior a v3.4.17, v3.5.x anterior a v3.5.15 y v3.6.x anterior a v3.6.5 no restringe correctamente las modificaciones en la base de datos de privilegios, permitiendo a usuarios remotos autenticados obtener la "toma de posesión" de privilegios a través de una conexión LSA. • http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079662.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079670.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079677.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00003.html http://marc.info/?l=bugtraq&m=134323086902585&w • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 75%CPEs: 144EXPL: 1CVE-2012-1182 – Samba ReportEventW Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1182
The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. El generador de código RPC de Samba 3.x anteriores a 3.4.16, 3.5.x anteriores a 3.5.14, y 3.6.x anteriores a 3.6.4 no implementa la validación de una longitud de array de una manera consistente con la validación de la reserva de memoria del array, lo que permite a atacantes remotos ejecutar código arbitrario a través de una llamada RPC modificada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samba. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way Samba handles ReportEventW requests. When parsing the data send in the request Samba uses the field 'strings' to create a heap allocation but then uses another field, 'num_of_strings', to write data to the allocation. • https://www.exploit-db.com/exploits/21850 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078258.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078726.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078836.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080567.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00007.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 8.3EPSS: 95%CPEs: 12EXPL: 0CVE-2012-0870 – samba: Any Batched ("AndX") request processing infinite recursion and heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2012-0870
Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion. Un desbordamiento de buffer basado en memoria dinámica (heap) en process.c de smbd en Samba v3.0, tal como se utiliza en el servicio de intercambio de archivos en la tableta BlackBerry PlayBook anterior a v2.0.0.7971 y otros productos, permite a atacantes remotos causar una denegación de servicio (caída de demonio) o posiblemente ejecutar código arbitrario a través de una por lotes (también conocido yx) que desencadena la solicitud de repetición infinita • http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB29565 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00014.html http://secunia.com/advisories/48116 http:& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 3%CPEs: 3EXPL: 0CVE-2012-0817
https://notcve.org/view.php?id=CVE-2012-0817
Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests. Fallo de memoria en smbd en Samba v3.6.x anterior a 3.6.3 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y CPU)realizando numerosas peticiones de conexión. • http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072930.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00014.html http://secunia.com/advisories/47763 http://secunia.com/advisories/48879 http://www.samba.org/samba/history/samba-3.6.3.html http://www.samba.org/samba/security/CVE-2012-0817 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.7EPSS: 0%CPEs: 4EXPL: 0CVE-2011-3585 – Samba mtab lock file race condition
https://notcve.org/view.php?id=CVE-2011-3585
Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists. Múltiples condiciones de carrera en los programas (1) mount.cifs y (2) umount.cifs en Samba versión 3.6, permiten a usuarios locales causar una denegación de servicio (interrupción del montaje) por medio de una señal SIGKILL durante una ventana de tiempo cuando existe el archivo /etc/mtab~. • https://bugzilla.redhat.com/show_bug.cgi?id=742907 https://bugzilla.samba.org/show_bug.cgi?id=7179 https://git.samba.org/?p=cifs-utils.git%3Ba=commitdiff%3Bh=810f7e4e0f2dbcbee0294d9b371071cb08268200 https://www.openwall.com/lists/oss-security/2011/09/27/1 https://www.openwall.com/lists/oss-security/2011/09/30/5 https://access.redhat.com/security/cve/CVE-2011-3585 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •