CVSS: 5.0EPSS: 96%CPEs: 177EXPL: 1CVE-2013-4124 – Samba 3.5.22/3.6.17/4.0.8 - nttrans Reply Integer Overflow
https://notcve.org/view.php?id=CVE-2013-4124
Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. Desbordamiento de entero en la función read_nttrans_ea_list en nttrans.c en smbd en Samba v3.x anterior a v3.5.22, v3.6.x anterior a v3.6.17, y v4.x anterior a v4.0.8 permite a atacantes remotos causar una denegación de servicio (por excesivo consumo de memoria) a través de un paquete con formato erróneo. Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. Important Note: in order to work, the "ea support" option on the target share must be enabled. • https://www.exploit-db.com/exploits/27778 http://archives.neohapsis.com/archives/bugtraq/2013-08/0028.html http://ftp.samba.org/pub/samba/patches/security/samba-4.0.7-CVE-2013-4124.patch http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113591.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114011.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00012&# • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 4.0EPSS: 0%CPEs: 9EXPL: 0CVE-2013-0454
https://notcve.org/view.php?id=CVE-2013-0454
The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter. Samba anterior a v3.6.6, tal como se utiliza en el IBM Storwize V7000 Unified v1.3 anterior a v1.3.2.3, y v1.4 anterior a v1.4.0.1 y posiblemente otros productos, no se aplican correctamente los atributos de CIFS de compartición, lo que permite a usuarios remotos autenticados para (1) escribir en un participación de sólo lectura, (2) disparar problemas de integridad de datos relacionados con la operación de bloqueo, bloqueo, coherencia, arrendamiento de atributo, o (3) tener un impacto no especificado mediante el aprovechamiento de la manipulación incorrecta del parámetro "hide unreadable". • http://www.ibm.com/support/docview.wss?uid=ssg1S1004289 http://www.ubuntu.com/usn/USN-1802-1 https://bugzilla.redhat.com/show_bug.cgi?id=928419 https://bugzilla.samba.org/show_bug.cgi?id=8738 https://exchange.xforce.ibmcloud.com/vulnerabilities/80970 https://lists.samba.org/archive/samba-announce/2012/000259.html https://www.samba.org/samba/security/CVE-2013-0454 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.1EPSS: 4%CPEs: 163EXPL: 0CVE-2013-0213 – samba: clickjacking vulnerability in SWAT
https://notcve.org/view.php?id=CVE-2013-0213
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element. Samba Web Administration Tool (SWAT) en Samba v3.x anterior a v3.5.21, v3.6.x anterior a v3.6.12, y v4.x anterior a v4.0.2 permite a atacantes remotos llevar a cabo attaques de clickjacking mediante un (1) FRAME o un (2) elemento IFRAME • http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00042.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00029.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00033.html http://rhn.redhat.com/errata/RHSA-2013-1310.html http://rhn.redhat.com/errata/RHSA-2013-1542.html http://rhn.redhat.com/errata/RHSA-2014-0305.html http://www.debian.org/security/2013/dsa-2617 http:/ • CWE-20: Improper Input Validation •
CVSS: 5.1EPSS: 1%CPEs: 163EXPL: 0CVE-2013-0214 – samba: cross-site request forgery vulnerability in SWAT
https://notcve.org/view.php?id=CVE-2013-0214
Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el Samba Web Administration Tool (SWAT)en Samba v3.x anterior a v3.5.21, v3.6.x anterior a v3.6.12, y v4.x anterior a v4.0.2, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección para aprovecharse de la contraseña y hacer peticiones que lleven a cabo acciones SWAT • http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00042.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00029.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00033.html http://osvdb.org/89627 http://rhn.redhat.com/errata/RHSA-2013-1310.html http://rhn.redhat.com/errata/RHSA-2013-1542.html http://rhn.redhat.com/errata/RHSA-2014-0305.html http://www.debian.org/security&# • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 81%CPEs: 144EXPL: 1CVE-2012-1182 – Samba ReportEventW Heap Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-1182
The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. El generador de código RPC de Samba 3.x anteriores a 3.4.16, 3.5.x anteriores a 3.5.14, y 3.6.x anteriores a 3.6.4 no implementa la validación de una longitud de array de una manera consistente con la validación de la reserva de memoria del array, lo que permite a atacantes remotos ejecutar código arbitrario a través de una llamada RPC modificada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samba. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way Samba handles ReportEventW requests. When parsing the data send in the request Samba uses the field 'strings' to create a heap allocation but then uses another field, 'num_of_strings', to write data to the allocation. • https://www.exploit-db.com/exploits/21850 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078258.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078726.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078836.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080567.html http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00007.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •