Use-after-free in Samba AD DC LDAP Server with ASQ

Description Samba has, since Samba 4.0, supported the Paged Results LDAP feature, to allow clients to obtain pages of search results against a Samba AD DC using an LDAP control. Since Samba 4.7.11 and 4.8.6 a Denial of Service prevention has been in place in this module, to age out old client...

UBUNTU-CVE-2020-10704

A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerabilit...

UBUNTU-CVE-2020-10700

A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before...

Scientific Linux Security Update : samba on SL7.x x86_64 (20200407)

samba: Combination of parameters and permissions can allow user to escape from the share path definition samba: smb client vulnerable to filenames containing path separators C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2020-1511)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1511)

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions...

Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. The vulnerability exist as an input validation flaw was found in the way Samba handled Any Batched AndX requests. A remote, unauthenticated attacker could send a specially-crafted SMB packet to the Samba server, possibly resulting in arbitrary code...

Information Disclosure

samba is vulnerable to information disclosure. The vulnerability exists as the default Samba server configuration enabled both the "wide links" and "unix extensions" options, allowing Samba clients with write access to a share to create symbolic links that point to any location on the file system...

Denial Of Service (DoS)

samba is vulnerable to denial of service. It was found that the fix for CVE-2010-0547, provided by the Samba rebase in RHBA-2011:0054, was incomplete. The mount.cifs tool did not properly handle share or directory names containing a newline character, allowing a local attacker to corrupt the mtab...

Cross-Site Scripting (XSS)

samba is vulnerable to cross-site scripting XSS. A cross-site scripting XSS flaw was found in the password change page of the Samba Web Administration Tool SWAT. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead t...

Cross-Site Request Forgery (CSRF)

samba is vulnerable to cross-site request forgery CSRF. It was found that SWAT web pages did not protect against Cross-Site Request Forgery CSRF attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could...

Insecure Resource Limit Verification

samba does not properly verify resource limits. It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cif...

Denial Of Service (DoS)

samba is vulnerable to denial of service. A flaw was found in the way Samba handled file descriptors. If an attacker were able to open a large number of file descriptors on the Samba server, they could flip certain stack bits to "1" values, resulting in the Samba server smbd crashing...

Denial Of Service (DoS)

samba is vulnerable to denial of service. The application does not verify device name and mountpoint strings, allowing local users to crash the application via a malicious string...

Symlink Attack

samba is vulnerable to symlink attack. Local users are able to mount a CIFS share on an arbitrary mountpoint using symlinks on the mountpoint directory file to gain additional privileges...

Denial Of Service (DoS)

Samba vulnerable to Denial Of Service DoS. Due to an input sanitization flaw in the way Samba parsed client data, a malicious client could send a specially-crafted SMB packet to the Samba server, resulting in arbitrary code execution with the privileges of the Samba server smbd...

Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. A missing array boundary checking flaw was found in the way Samba parsed the binary representation of Windows security identifiers SIDs. A malicious client could send a specially-crafted SMB request to the Samba server, resulting in arbitrary code...

Information Disclosure

Samba is vulnerable to Information Disclosure. The mount.cifs program printed CIFS passwords as part of its debug output when running in verbose mode. When mount.cifs had the setuid bit set, a local, unprivileged user could use this flaw to disclose passwords from a file that would otherwise be...

Denial Of Service (DoS)

Samba is vulnerable to Denial of Service DoS. A denial of service flaw was found in the Samba smbd daemon. An authenticated, remote user could send a specially-crafted response that would cause an smbd child process to enter an infinite loop. An authenticated, remote user could use this flaw to...

Access Restriction Bypass

Samba is vulnerable to Access Restriction Bypass. A flaw was discovered in the way Samba handled users without a home directory set in the back-end password database e.g. "/etc/passwd". If a share for the home directory of such a user was created e.g. using the automated "homes" share, any user...