Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 291

Export CSV
CVE-2015-5296

samba: client requesting encryption vulnerable to downgrade attack

Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.

CVSS 3.1 · 5.4 Medium EPSS 7.3% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2015-5299

Samba: Missing access control check in shadow copy code

The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.

CVSS 3.1 · 5.3 Medium EPSS 13.6% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2015-5330

libldb: remote memory read in the Samba LDAP server

ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.

CVSS 3.0 · 7.5 High EPSS 6.2% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Storage Samba
CVE-2015-7540

samba: DoS to AD-DC due to insufficient checking of asn1 memory allocation

The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.

CVSS 3.1 · 7.5 High EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2015-7560

samba: Incorrect ACL get/set allowed on symlink path

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.

CVSS 3.1 · 6.5 Medium EPSS 12.9% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2015-8467

samba: Denial of service attack against Windows Active Directory server.

The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Samba
Products
Ubuntu Linux Debian Linux Samba
CVE-2016-0771

samba: Out-of-bounds read in internal DNS server

The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.

CVSS 3.0 · 5.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Samba
Products
Samba
CVE-2016-2110

samba: Man-in-the-middle attacks possible with NTLMSSP authentication

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.

CVSS 3.0 · 5.9 Medium EPSS 8.3% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 5 more
CVE-2016-2111

samba: Spoofing vulnerability when domain controller is configured

The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.

CVSS 3.0 · 6.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 5 more
CVE-2016-2112

samba: Missing downgrade detection

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 9.4% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 4 more
CVE-2016-2113

samba: Server certificates not validated at client side

Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.

CVSS 3.0 · 7.4 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 4 more
CVE-2016-2114

samba: Samba based active directory domain controller does not enforce smb signing

The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 4 more
CVE-2016-2115

samba: Smb signing not required by default when smb client connection is used for ipc usage

Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 10.2% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 4 more
CVE-2016-2118

samba: SAMR and LSA man in the middle attacks

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

CVSS 3.1 · 7.5 High EPSS 37.2% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2016-2119

samba: Client side SMB2/3 required signing can be downgraded

libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Storage Samba
CVE-2011-1097

rsync: Incremental file-list corruption due to temporary file_extra_cnt increments

rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.

CVSS 2.0 · 5.1 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Rsync
CVE-2011-2694

(SWAT): XSS flaw in Change Password page

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).

CVSS 2.0 · 2.6 Low EPSS 6.0% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2011-2522

(SWAT): Absent CSRF protection in various Samba web configuration formulars

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.

CVSS 2.0 · 6.8 Medium EPSS 10.6% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2011-0719

Samba unsafe fd_set usage

Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba
CVE-2013-0214

samba: cross-site request forgery vulnerability in SWAT

Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.

CVSS 2.0 · 5.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba