Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 225

Export CSV
CVE-2013-0454

samba: the SMB2 server does not release unused shares

The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.

CVSS 2.0 · 4.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Ibm Samba
Products
Ubuntu Linux Storwize Samba
CVE-2010-0547

samba: mount.cifs improper device name and mountpoint strings sanitization

client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba
CVE-2012-6150

samba: pam_winbind fails open when non-existent group specified to require_membership_of

The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.

CVSS 2.0 · 3.6 Low EPSS 3.8% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Samba
CVE-2013-1863

samba4: Samba 4.0 AD DC files (initially) created as world-writable if additional CIFS file shares are created on the AD DC

Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.

CVSS 2.0 · 6.0 Medium EPSS 2.2% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2013-4408

samba: Heap-based buffer overflow due to incorrect DCE-RPC fragment length field check

Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.

CVSS 2.0 · 8.3 High EPSS 2.7% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Storage Samba
CVE-2013-4476

samba: world-readable key.pem with Samba 4 AD DC

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2013-4475

samba: no access check verification on stream files

Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).

CVSS 2.0 · 4.0 Medium EPSS 9.0% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2022-3592

samba: wide links protection broken

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Samba
Products
Fedora Samba
CVE-2022-45141

samba: Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets

Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2021-20251

samba: Race condition in the bad password lockout code

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Samba
Products
Fedora Samba
CVE-2023-0225

samba: AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users

A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2018-14628

samba: Unprivileged read of deleted object tombstones in AD LDAP server

An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Samba
Products
Fedora Samba
CVE-2023-0922

samba: AD DC admin tool samba-tool sends passwords in cleartext

The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2023-0614

samba: Access controlled AD LDAP attributes can be discovered

The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2019-14907

samba: Crash after failed character conversion at log level 3 or above

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-3870

samba: World writable files in Samba AD DC private/ dir

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Samba Synology
Products
Fedora Samba Directory Server and 6 more
CVE-2019-19344

samba: Use after free during DNS zone scavenging in Samba AD DC

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Opensuse Samba and 1 more
Products
Ubuntu Linux Leap Samba and 4 more