Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 291

Export CSV
CVE-2012-2111

samba: Incorrect permission checks when granting/removing privileges

The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.

CVSS 2.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba
CVE-2012-6150

samba: pam_winbind fails open when non-existent group specified to require_membership_of

The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.

CVSS 2.0 · 3.6 Low EPSS 3.8% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Samba
CVE-2013-0172

samba4: may provide authenticated users with write access to LDAP directory objects when used as an AD DC

Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.

CVSS 2.0 · 3.5 Low EPSS 2.4% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2013-0213

samba: clickjacking vulnerability in SWAT

The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.

CVSS 2.0 · 5.1 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba
CVE-2022-3592

samba: wide links protection broken

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Samba
Products
Fedora Samba
CVE-2022-45141

samba: Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2021-20251

samba: Race condition in the bad password lockout code

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Samba
Products
Fedora Samba
CVE-2023-0225

samba: AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users

A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2018-14628

samba: Unprivileged read of deleted object tombstones in AD LDAP server

An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Samba
Products
Fedora Samba
CVE-2023-0922

samba: AD DC admin tool samba-tool sends passwords in cleartext

The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2023-0614

samba: Access controlled AD LDAP attributes can be discovered

The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2019-3870

samba: World writable files in Samba AD DC private/ dir

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Samba Synology
Products
Fedora Samba Directory Server and 6 more
CVE-2019-14907

samba: Crash after failed character conversion at log level 3 or above

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-19344

samba: Use after free during DNS zone scavenging in Samba AD DC

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Opensuse Samba and 1 more
Products
Ubuntu Linux Leap Samba and 4 more
CVE-2023-4154

Samba: ad dc password exposure to privileged users and rodcs

A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Storage Samba
CVE-2022-4603

ppp pppdump pppdump.c dumpppp array index

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Ppp
CVE-2022-3437

samba: heap buffer overflow in GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

CVSS 3.1 · 4.3 Medium EPSS 4.0% KEV · Not listed
Vendors
Fedoraproject Samba
Products
Fedora Samba