Lucene search

Ubuntu.comUB:CVE-2009-1886

HistoryJun 25, 2009 - 12:00 a.m.

CVE-2009-1886

2009-06-2500:00:00

ubuntu.com

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.017 Low

EPSS

Percentile

87.8%

JSON

Multiple format string vulnerabilities in client/client.c in smbclient in
Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to
execute arbitrary code via format string specifiers in a filename.

Notes

Author	Note
jdstrand	priority low as the vulnerability is reduced to denial of service due to compiler hardening does not affect 3.0 or 3.3
mdeslaur	confirmed trapped by compiler hardening, although could still be a DoS for tools that use smbclient in an automated way, so marking as low priority

OSVersionArchitecturePackageVersionFilename
ubuntu8.10noarchsamba< 2:3.2.3-1ubuntu3.6UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.10	noarch	samba	< 2:3.2.3-1ubuntu3.6	UNKNOWN

References

www.samba.org/samba/security/CVE-2009-1886.html

launchpad.net/bugs/cve/CVE-2009-1886

nvd.nist.gov/vuln/detail/CVE-2009-1886

security-tracker.debian.org/tracker/CVE-2009-1886

ubuntu.com/security/notices/USN-839-1

www.cve.org/CVERecord?id=CVE-2009-1886

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.017 Low

EPSS

Percentile

87.8%

JSON

Related for UB:CVE-2009-1886