Lucene search

K
freebsdFreeBSD0FA15E08-92EC-11E1-A94A-00215C6A37BB
HistoryApr 30, 2012 - 12:00 a.m.

samba -- incorrect permission checks vulnerability

2012-04-3000:00:00
vuxml.freebsd.org
15

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.8%

The Samba project reports:

Samba versions 3.4.x to 3.6.4 inclusive are affected
by a vulnerability that allows arbitrary users to modify
privileges on a file server.
Security checks were incorrectly applied to the Local
Security Authority (LSA) remote proceedure calls (RPC)
CreateAccount, OpenAccount, AddAccountRights and
RemoveAccountRights allowing any authenticated user
to modify the privileges database.
This is a serious error, as it means that authenticated
users can connect to the LSA and grant themselves the
“take ownership” privilege. This privilege is used by the
smbd file server to grant the ability to change ownership
of a file or directory which means users could take ownership
of files or directories they do not own.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchsamba34< 3.4.17UNKNOWN
FreeBSDanynoarchsamba35< 3.5.15UNKNOWN
FreeBSDanynoarchsamba36< 3.6.5UNKNOWN

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.8%