CVSS: 5.8EPSS: 0%CPEs: 9EXPL: 2CVE-2009-1888 – Samba improper file access
https://notcve.org/view.php?id=CVE-2009-1888
The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory. La función acl_group_override en smbd/posix_acls.c en smbd en Samba v3.0.x anterior a v3.0.35, v3.1.x y v3.2.x anterior a v3.2.13, y v3.3.x anterior 3.3.6, cuando el modo de fichero dos está habilitado, permite a atacantes remotos modificar la lista de control de acceso para ficheros a través de vectores relacionados con acceso de lectura a memoria sin inicializar. • http://secunia.com/advisories/35539 http://secunia.com/advisories/35573 http://secunia.com/advisories/35606 http://secunia.com/advisories/36918 http://wiki.rpath.com/Advisories:rPSA-2009-0145 http://www.debian.org/security/2009/dsa-1823 http://www.mandriva.com/security/advisories?name=MDVSA-2009:196 http://www.samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch http:&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.3EPSS: 80%CPEs: 7EXPL: 0CVE-2009-0022
https://notcve.org/view.php?id=CVE-2009-0022
Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name. Samba v3.2.0 hasta v3.2.6, cuando el registro de acciones está habilitado, permite a usuarios autenticados remotamente acceder al sistema de ficheros raíz a través de una petición de conexión manipulada que especifica un nombre de recurso compartido en blanco. • http://master.samba.org/samba/ftp/patches/security/samba-3.2.6-CVE-2009-0022.patch http://osvdb.org/51152 http://secunia.com/advisories/33379 http://secunia.com/advisories/33392 http://secunia.com/advisories/33431 http://www.mandriva.com/security/advisories?name=MDVSA-2009:042 http://www.samba.org/samba/security/CVE-2009-0022.html http://www.securityfocus.com/bid/33118 http://www.securitytracker.com/id?1021513 http://www.vupen.com/english/advisories/2009/0017 https:&# • CWE-20: Improper Input Validation •
CVSS: 8.5EPSS: 4%CPEs: 10EXPL: 0CVE-2008-4314
https://notcve.org/view.php?id=CVE-2008-4314
smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a "cut&paste error" that causes an improper bounds check to be performed. Una vulnerabilidad en smbd en versiones de Samba desde la 3.0.29 hasta la 3.2.4 podría permitir a atacantes remotos leer zonas arbitrarias de memoria y causar una denegación de servicio a través de peticiones modificadas de (1)trans, (2) trans2, y (3) nttrans. Esta vulnerabilidad está relacionada con un error "cortado y pegado" que causa un control de límites inadecuado. • http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html http://marc.info/?l=bugtraq&m=125003356619515&w=2 http://osvdb.org/50230 http://secunia.com/advisories/32813 http://secunia.com/advisories/32919 http://secunia.com/advisories/32951 http://secunia.com/advisories/32968 http://secunia.com/advisories/36281 http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.453684 http://sunsolve.sun.com/search/document.do?assetkey=1-26- • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-3789
https://notcve.org/view.php?id=CVE-2008-3789
Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups. Samba 3.2.0 usa permisos débiles (0666) para los archivos (1) group_mapping.tdb y (2) group_mapping.ldb, lo que permite a usuarios locales modificar la pertenencia a los Grupos Unix. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496073 http://samba.org/samba/security/CVE-2008-3789.html http://secunia.com/advisories/31601 http://www.openwall.com/lists/oss-security/2008/08/26/2 http://www.securityfocus.com/bid/30837 http://www.securitytracker.com/id?1020770 http://www.vupen.com/english/advisories/2008/2440 https://exchange.xforce.ibmcloud.com/vulnerabilities/44678 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 97%CPEs: 6EXPL: 1CVE-2008-1105 – Samba 3.0.29 (Client) - 'receive_smb_raw()' Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2008-1105
Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response. Desbordamiento de búfer basado en montículo en la función receive_smb_raw de util/sock.c en Samba 3.0.0 hasta 3.0.29, permite a atacantes remotos ejecutar código de su elección a través de una respuesta SMB manipulada. • https://www.exploit-db.com/exploits/5712 http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00000.html http://lists.vmware.com/pipermail/security-announce/2008/000023.html http://secunia.com/advisories/30228 http://secunia.com/advisories/30385 http://secunia.com/advisories/30396 http://secunia.com/advisories/30442 http://secunia.com/advisories/30449 http://secunia.com/advisories/30478 http:/&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •