CVE-2015-7560

2016-03-0800:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.003

Percentile

68.2%

JSON

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x
before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote
authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to
create a symlink, and then using a non-UNIX SMB1 call to write to the ACL
content.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchsamba< 2:3.6.3-2ubuntu2.17UNKNOWN
ubuntu14.04noarchsamba< 2:4.1.6+dfsg-1ubuntu2.14.04.13UNKNOWN
ubuntu15.10noarchsamba< 2:4.1.17+dfsg-4ubuntu3.3UNKNOWN
ubuntu16.04noarchsamba< 2:4.3.6+dfsg-1ubuntu1UNKNOWN
ubuntu16.10noarchsamba< 2:4.3.6+dfsg-1ubuntu1UNKNOWN
ubuntu17.04noarchsamba< 2:4.3.6+dfsg-1ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	samba	< 2:3.6.3-2ubuntu2.17	UNKNOWN
ubuntu	14.04	noarch	samba	< 2:4.1.6+dfsg-1ubuntu2.14.04.13	UNKNOWN
ubuntu	15.10	noarch	samba	< 2:4.1.17+dfsg-4ubuntu3.3	UNKNOWN
ubuntu	16.04	noarch	samba	< 2:4.3.6+dfsg-1ubuntu1	UNKNOWN
ubuntu	16.10	noarch	samba	< 2:4.3.6+dfsg-1ubuntu1	UNKNOWN
ubuntu	17.04	noarch	samba	< 2:4.3.6+dfsg-1ubuntu1	UNKNOWN