(SWAT): Absent CSRF protection in various Samba web configuration formulars

Multiple cross-site request forgery CSRF vulnerabilities in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that 1 shut down daemons, 2 start daemons, 3 add shares, 4 remove shares, 5 add printers...

Moderate: Red Hat Security Advisory: samba3x security update

Updated samba3x packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

(SWAT): XSS flaw in Change Password page

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

samba: mount.cifs improper device name and mountpoint strings sanitization

client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the 1 device name and 2 mountpoint strings are composed of valid characters, which allows local users to cause a denial of service mtab corruption via a crafted string...

Moderate: Red Hat Security Advisory: samba security update

Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings,...

samba: Race condition by mount (mount.cifs) operations

client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file...

(SWAT): Absent CSRF protection in various Samba web configuration formulars

Multiple cross-site request forgery CSRF vulnerabilities in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that 1 shut down daemons, 2 start daemons, 3 add shares, 4 remove shares, 5 add printers...

(SWAT): XSS flaw in Change Password page

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

Samba mtab lock file race condition

Multiple race conditions in the 1 mount.cifs and 2 umount.cifs programs in Samba 3.6 allow local users to cause a denial of service mounting outage via a SIGKILL signal during a time window when the /etc/mtab file exists...

samba/cifs-utils: mount.cifs and umount.cifs fail to anticipate RLIMIT_FSIZE

smbfs in Samba 3.5.8 and earlier attempts to use 1 mount.cifs to append to the /etc/mtab file and 2 umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process wi...

PT-2011-1101 · Samba +1 · Samba +1

Name of the Vulnerable Software and Affected Versions: Samba versions 3.5.6 through 3.6 Description: The issue involves multiple race conditions in the mount.cifs and umount.cifs programs, allowing local users to cause a denial of service via a SIGKILL signal during a specific time window when th...

PT-2011-1098 · Samba Team +2 · Cifs-Utils +2

Name of the Vulnerable Software and Affected Versions: Samba versions prior to 3.5.15 Samba version 3.5.6 Samba version 3.5.10 and earlier cifs-utils version 4.8.1 Description: The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotel...

samba security update

3.0.33-3.29.el5.4 - Security Release, Add fix also for CVE-2011-2724 - related: 722552 3.0.33-3.29.el5.3 - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694, CVE-2011-2522, CVE-2011-1678 - resolves: 722552...

samba and cifs-utils security and bug fix update

cifs-utils: 4.8.1-2.2 - fix handling of checknewline return code in mount.cifs bz 725508 4.8.1-2.1 - mount.cifs: handle ENOSPC/EFBIG condition when altering mtab bz 725508 samba: 3.5.6-86.4 - Fix cleartext authentication after applying Windows security patch KB2536276 - resolves: 728517 3.5.6-86....

Samba Web Administration Tool vulnerable to cross-site scripting

Overview Samba Web Administration Tool contains a cross-site scripting vulnerability. Samba Web Administration Tool SWAT allows for Samba configuration through a web interface. SWAT contains a cross-site scripting vulnerability. SWAT is disabled in a default configuration of Samba. nobuhiro tsuji...

Samba Web Administration Tool vulnerable to cross-site request forgery

Overview Samba Web Administration Tool SWAT contains a cross-site request forgery vulnerability. Samba Web Administration Tool SWAT allows for Samba configuration through a web interface. SWAT contains a cross-site request forgery vulnerability. SWAT is disabled in a default configuration of Samb...

Mac OS X v10.6.6 Multiple Vulnerabilities (2011-001)

This host is missing an important security update according to Mac OS X 10.6.6 Update/Mac OS X Security Update 2011-001. OpenVAS Vulnerability Test $Id: secpodmacosxsu11-001.nasl 7015 2017-08-28 11:51:24Z teissa $ Mac OS X v10.6.6 Multiple Vulnerabilities 2011-001 Authors: Antu Sanadi Copyright:...

JVN#29529126: Samba Web Administration Tool vulnerable to cross-site request forgery

Samba Web Administration Tool SWAT allows for Samba configuration through a web interface. SWAT contains a cross-site request forgery vulnerability. SWAT is disabled in a default configuration of Samba. Impact When a user is logged in to SWAT as root, an attacker may change configurations in Samb...

JVN#63041502: Samba Web Administration Tool vulnerable to cross-site scripting

Samba Web Administration Tool SWAT allows for Samba configuration through a web interface. SWAT contains a cross-site scripting vulnerability. SWAT is disabled in a default configuration of Samba. Impact An arbitrary script may be executed on the web browser of a user that is logged into SWAT...

Fedora Update for samba FEDORA-2011-10367

Check for the Version of samba OpenVAS Vulnerability Test Fedora Update for samba FEDORA-2011-10367 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...