samba -- multiple vulnerabilities

2014-03-1100:00:00

vuxml.freebsd.org

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.007 Low

EPSS

Percentile

80.7%

JSON

Samba project reports:

In Samba’s SAMR server we neglect to ensure that attempted
password changes will update the bad password count, nor set
the lockout flags. This would allow a user unlimited attempts
against the password by simply calling ChangePasswordUser2
repeatedly.
This is available without any other authentication.

smbcacls can remove a file or directory ACL by mistake.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchsamba36< 3.6.23UNKNOWN
FreeBSDanynoarchsamba4< 4.0.16UNKNOWN
FreeBSDanynoarchsamba41< 4.1.6UNKNOWN