Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. A missing array boundary checking flaw was found in the way Samba parsed the binary representation of Windows security identifiers SIDs. A malicious client could send a specially-crafted SMB request to the Samba server, resulting in arbitrary code...

Information Disclosure

Samba is vulnerable to Information Disclosure. The mount.cifs program printed CIFS passwords as part of its debug output when running in verbose mode. When mount.cifs had the setuid bit set, a local, unprivileged user could use this flaw to disclose passwords from a file that would otherwise be...

Denial Of Service (DoS)

Samba is vulnerable to Denial of Service DoS. A denial of service flaw was found in the Samba smbd daemon. An authenticated, remote user could send a specially-crafted response that would cause an smbd child process to enter an infinite loop. An authenticated, remote user could use this flaw to...

Access Restriction Bypass

Samba is vulnerable to Access Restriction Bypass. A flaw was discovered in the way Samba handled users without a home directory set in the back-end password database e.g. "/etc/passwd". If a share for the home directory of such a user was created e.g. using the automated "homes" share, any user...

Unauthorized Access Control Modification

Samba is vulnerable Unauthorized Access Control Modification. An uninitialized data access flaw was discovered in the smbd daemon when using the non-default "dos filemode" configuration option in "smb.conf". An authenticated, remote user with write access to a file could possibly use this flaw to...

Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. A heap-based buffer overflow flaw was found in the way Samba clients handle over-sized packets. If a client connected to a malicious Samba server, it was possible to execute arbitrary code as the Samba client user. It was also possible for a remote...

Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. A stack buffer overflow flaw was found in the way Samba authenticates remote users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash, or execute arbitrary code with the permissions of the Samba server...

Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code...

Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. A heap-based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution i...

Privilege Escalation

samba is vulnerable to privilege escalation. A flaw was found in the way Samba assigned group IDs under certain conditions. If the "winbind nss info" parameter in smb.conf is set to either "sfu" or "rfc2307", Samba users are incorrectly assigned the group ID of 0...

CentOS 7 : samba (RHSA-2020:1084)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1084 advisory. - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set i...

CVE-2019-14861

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the poorly named dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default...

CVE-2019-19344

A flaw was found in samba. An off-by-default feature to tombstone dynamically created DNS records once they have reached their expiry time contains a use-after-free flaw that allows read memory to be saved back into the database. The highest threat from this vulnerability is to system availabilit...

ctdb, libsmbclient, libwbclient, samba security update

CentOS Errata and Security Advisory CESA-2020:1084 An update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

The vulnerability of the Samba Active Directory domain controller in the Samba networking software package allows a perpetrator to circumvent existing security restrictions through brute-force attacks.

The vulnerability of the Samba Domain Controller in the Active Directory software for network interactions involves flaws in the password-changing mechanism. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions through brute-force attacks...

The vulnerability of the LDAP dirsync component in the Samba networking software allows a hacker to induce a service failure.

The vulnerability of the LDAP dirsync component in the Samba networking software package involves a pointer manipulation issue. Exploiting this vulnerability could allow an attacker to cause service failures...

samba security, bug fix, and enhancement update

4.10.4-10 - resolves: 1786324 - fix security level check for DsRGetForestTrustInformation 4.10.4-9 - resolves: 1764468 - Fix CVE-2019-10218 4.10.4-8 - resolves: 1656541 - Fix join using netbios name 4.10.4-7 - resolves: 1657428 - Fix spnego downgrade - resolves: 1663064 - Fix net ads join in...

CVE-2019-10197

A flaw was found in samba when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside of the share. Mitigation The following methods can be used as a mitigation only...

CVE-2019-10218

A flaw was found in the samba client where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working...

CVE-2019-12436

Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit. Mitigation Return to the default configuration ...