CVSS: 10.0EPSS: 75%CPEs: 144EXPL: 1CVE-2012-1182 – Samba ReportEventW Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1182
The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. El generador de código RPC de Samba 3.x anteriores a 3.4.16, 3.5.x anteriores a 3.5.14, y 3.6.x anteriores a 3.6.4 no implementa la validación de una longitud de array de una manera consistente con la validación de la reserva de memoria del array, lo que permite a atacantes remotos ejecutar código arbitrario a través de una llamada RPC modificada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samba. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way Samba handles ReportEventW requests. When parsing the data send in the request Samba uses the field 'strings' to create a heap allocation but then uses another field, 'num_of_strings', to write data to the allocation. • https://www.exploit-db.com/exploits/21850 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078258.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078726.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078836.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080567.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00007.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 2.6EPSS: 0%CPEs: 192EXPL: 0CVE-2011-2724 – cifs-utils: mount.cifs incorrect fix for CVE-2010-0547
https://notcve.org/view.php?id=CVE-2011-2724
The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547. La función check_mtab en client/mount.cifs.c en mount.cifs en smbfs en Samba v3.5.10 y anteriores no verifica correctamente que el (1) nombre del dispositivo y (2) las cadenas de punto de montaje se componen de caracteres válidos, lo que permite causar a los usuarios locales una denegación de servicio (corrupción de mtab) a través de una cadena de texto hecha a mano. NOTA: esta vulnerabilidad existe debido a una solución incorrecta para el CVE-2.010-0547. • http://comments.gmane.org/gmane.linux.kernel.cifs/3827 http://git.samba.org/?p=cifs-utils.git%3Ba=commit%3Bh=1e7a32924b22d1f786b6f490ce8590656f578f91 http://openwall.com/lists/oss-security/2011/07/29/9 http://secunia.com/advisories/45798 http://www.mandriva.com/security/advisories?name=MDVSA-2011:148 http://www.redhat.com/support/errata/RHSA-2011-1220.html http://www.redhat.com/support/errata/RHSA-2011-1221.html http://www.securitytracker.com/id?1025984 https://bugzilla.redhat.com& • CWE-20: Improper Input Validation •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-1678 – samba/cifs-utils: mount.cifs and umount.cifs fail to anticipate RLIMIT_FSIZE
https://notcve.org/view.php?id=CVE-2011-1678
smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089. smbfs en Samba v3.5.8 y anteriores, un intento de utilizar (1) mount.cifs para añadir al fichero /etc/mtab y (2) umount.cifs para añadir al fichero /etc/mtab.tmp sin primero verificar si los límites del recursos pudieran interferir, permitiría a usuarios locales provocar la corrupción del fichero /etc/mtab a través de un proceso con un valor RLIMIT_FSIZE pequeño, un asunto relacionado con CVE-2011-1089. • http://openwall.com/lists/oss-security/2011/03/04/10 http://openwall.com/lists/oss-security/2011/03/04/11 http://openwall.com/lists/oss-security/2011/03/04/12 http://openwall.com/lists/oss-security/2011/03/04/9 http://openwall.com/lists/oss-security/2011/03/05/3 http://openwall.com/lists/oss-security/2011/03/05/7 http://openwall.com/lists/oss-security/2011/03/07/9 http://openwall.com/lists/oss-security/2011/03/14/16 http://openwall • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 29%CPEs: 104EXPL: 1CVE-2010-1635
https://notcve.org/view.php?id=CVE-2010-1635
The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) via a Negotiate Protocol request with a certain 0x0003 field value followed by a Session Setup AndX request with a certain 0x8003 field value. La función chain_reply de process.c de smbd de Samba anterior a v3.4.8, y v3.5.x anterior a v3.5.2 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero nulo -NULL- y caída del proceso) mediante una solicitud de negociación de protocolo (Negotiate Protocol) con determinado valor de campo 0x003 seguido de una solicitud Session Setup AndX con determinado valor de campo 0x8003. • http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=25452a2268ac7013da28125f3df22085139af12d http://samba.org/samba/history/samba-3.4.8.html http://samba.org/samba/history/samba-3.5.2.html http://security-tracker.debian.org/tracker/CVE-2010-1635 http://www.mandriva.com/security/advisories?name=MDVSA-2010:141 http://www.securityfocus.com/bid/40097 http://www.stratsec.net/Research/Advisories/Samba-Multiple-DoS-Vulnerabilities-%28SS-2010-005%29 http://www.vupen.com/english/advisories/2010&# •
CVSS: 5.0EPSS: 26%CPEs: 104EXPL: 1CVE-2010-1642
https://notcve.org/view.php?id=CVE-2010-1642
The reply_sesssetup_and_X_spnego function in sesssetup.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to trigger an out-of-bounds read, and cause a denial of service (process crash), via a \xff\xff security blob length in a Session Setup AndX request. La función reply_sesssetup_and_X_spnego de sesssetup.c de smbd de Samba anterior a v3.4.8, y v3.5.x anterior a v3.5.2, permite a atacantes remotos provocar una lectura fuera de rango y ocasionar una denegación de servicio (caída del proceso), a través de una longitud blob -binary large object- de seguridad \xff\xff en una solicitud Session Setup AndX. • http://git.samba.org/?p=samba.git%3Ba=commit%3Bh=9280051bfba337458722fb157f3082f93cbd9f2b http://samba.org/samba/history/samba-3.4.8.html http://samba.org/samba/history/samba-3.5.2.html http://security-tracker.debian.org/tracker/CVE-2010-1642 http://www.mandriva.com/security/advisories?name=MDVSA-2010:141 http://www.securityfocus.com/bid/40097 http://www.stratsec.net/Research/Advisories/Samba-Multiple-DoS-Vulnerabilities-%28SS-2010-005%29 http://www.vupen.com/english/advisories/2010&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •