Vulnerability-Lookup

BDU:2015-01184 (CVE-2009-2813)

Vulnerability from fstec – Published: 2016-07-06 – Updated: 2016-11-28 – View on bdu.fstec.ru Fixed

Title

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Summary

Множественные уязвимости пакета smbfs операционной системы Debian GNU/Linux, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена удаленным злоумышленником, прошедшим процедуру аутентификации

Severity

6.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:M/Au:S/C:P/I:P/A:P

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-264 - Разрешения, привилегии и средства управления доступом

Aliases

CVE-2009-2813, CVE-2009-2906, CVE-2009-2948, DSA-1908, ID:1401062

References

4 references

URL
http://www.debian.org/security/dsa-1908/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2813
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2948
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2906

Impacted products

1 product from 1 vendor

Vendors

Сообщество свободного программного обеспечения

Products

Debian GNU/Linux

Versions

до 5 (Debian GNU/Linux)

Product types

Operating system

Mitigations

Проблема может быть решена обновлением операционной системы до следующих версий пакетов в зависимости от архитектуры: Debian GNU/Linux 5: ppc: winbind - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 s390x: samba-dbg - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 i686: swat - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 hppa: samba-dbg - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 sparc: libsmbclient - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 x86-64: winbind - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 armel: winbind - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 alpha: samba-dbg - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 ia64: samba-common - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 mips: samba-dbg - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 noarch: samba-doc - 3.2.5-4lenny7 samba-doc-pdf - 3.2.5-4lenny7 mipsel: libsmbclient-dev - 3.2.5-4lenny7 libpam-smbpass - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 arm: libpam-smbpass - 3.2.5-4lenny7 samba-dbg - 3.2.5-4lenny7 smbclient - 3.2.5-4lenny7 samba-common - 3.2.5-4lenny7 libwbclient0 - 3.2.5-4lenny7 samba - 3.2.5-4lenny7 smbfs - 3.2.5-4lenny7 swat - 3.2.5-4lenny7 samba-tools - 3.2.5-4lenny7 libsmbclient - 3.2.5-4lenny7 libsmbclient-dev - 3.2.5-4lenny7 winbind - 3.2.5-4lenny7

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 5 (Debian GNU/Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b:\nDebian GNU/Linux 5:\n\tppc:\n\t\twinbind - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\ts390x:\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\ti686:\n\t\tswat - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\thppa:\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\tsparc:\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\tx86-64:\n\t\twinbind - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\tarmel:\n\t\twinbind - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\talpha:\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\tia64:\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\tmips:\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\tnoarch:\n\t\tsamba-doc - 3.2.5-4lenny7\n\t\tsamba-doc-pdf - 3.2.5-4lenny7\n\tmipsel:\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\tarm:\n\t\tlibpam-smbpass - 3.2.5-4lenny7\n\t\tsamba-dbg - 3.2.5-4lenny7\n\t\tsmbclient - 3.2.5-4lenny7\n\t\tsamba-common - 3.2.5-4lenny7\n\t\tlibwbclient0 - 3.2.5-4lenny7\n\t\tsamba - 3.2.5-4lenny7\n\t\tsmbfs - 3.2.5-4lenny7\n\t\tswat - 3.2.5-4lenny7\n\t\tsamba-tools - 3.2.5-4lenny7\n\t\tlibsmbclient - 3.2.5-4lenny7\n\t\tlibsmbclient-dev - 3.2.5-4lenny7\n\t\twinbind - 3.2.5-4lenny7",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": null,
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2016",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "06.07.2016",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-01184",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2009-2813, CVE-2009-2906, CVE-2009-2948, DSA-1908, ID:1401062",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Debian\u00a0GNU/Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c (CWE-264)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 smbfs \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Debian\u00a0GNU/Linux, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438  \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.debian.org/security/dsa-1908/\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2813\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2948\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2906",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-264",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6)"
}

CVE-2009-2813 (GCVE-0-2009-2813)

Vulnerability from cvelistv5 – Published: 2009-09-14 16:00 – Updated: 2024-08-07 06:07

Summary

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

30 references

URL	Tags
http://marc.info/?l=bugtraq&m=126514298313071&w=2	vendor-advisoryx_refsource_HP
http://news.samba.org/releases/3.4.2/	x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/507856/100…	mailing-listx_refsource_BUGTRAQ
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://news.samba.org/releases/3.2.15/	x_refsource_CONFIRM
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://sunsolve.sun.com/search/document.do?assetk…	vendor-advisoryx_refsource_SUNALERT
http://www.vupen.com/english/advisories/2009/2810	vdb-entryx_refsource_VUPEN
http://slackware.com/security/viewer.php?l=slackw…	vendor-advisoryx_refsource_SLACKWARE
http://secunia.com/advisories/37428	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36937	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-839-1	vendor-advisoryx_refsource_UBUNTU
http://news.samba.org/releases/3.0.37/	x_refsource_CONFIRM
http://www.samba.org/samba/security/CVE-2009-2813.html	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://support.apple.com/kb/HT3865	x_refsource_CONFIRM
http://www.securityfocus.com/bid/36363	vdb-entryx_refsource_BID
http://secunia.com/advisories/36918	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36701	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36893	third-party-advisoryx_refsource_SECUNIA
http://news.samba.org/releases/3.3.8/	x_refsource_CONFIRM
http://secunia.com/advisories/36953	third-party-advisoryx_refsource_SECUNIA
http://wiki.rpath.com/Advisories:rPSA-2009-0145	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://osvdb.org/57955	vdb-entryx_refsource_OSVDB
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA

Date Public

2009-09-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T06:07:36.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SSRT090212",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=126514298313071\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.4.2/"
          },
          {
            "name": "20091112 rPSA-2009-0145-1 samba samba-client samba-server samba-swat",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507856/100/0/threaded"
          },
          {
            "name": "FEDORA-2009-10172",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
          },
          {
            "name": "oval:org.mitre.oval:def:9191",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9191"
          },
          {
            "name": "HPSBUX02479",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=126514298313071\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.2.15/"
          },
          {
            "name": "APPLE-SA-2009-09-10-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html"
          },
          {
            "name": "1021111",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021111.1-1"
          },
          {
            "name": "ADV-2009-2810",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2810"
          },
          {
            "name": "SSA:2009-276-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
          },
          {
            "name": "37428",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37428"
          },
          {
            "name": "36937",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36937"
          },
          {
            "name": "USN-839-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-839-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.0.37/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.samba.org/samba/security/CVE-2009-2813.html"
          },
          {
            "name": "oval:org.mitre.oval:def:7257",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7257"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT3865"
          },
          {
            "name": "36363",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/36363"
          },
          {
            "name": "36918",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36918"
          },
          {
            "name": "36701",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36701"
          },
          {
            "name": "36893",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36893"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.3.8/"
          },
          {
            "name": "36953",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36953"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.rpath.com/Advisories:rPSA-2009-0145"
          },
          {
            "name": "oval:org.mitre.oval:def:7211",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7211"
          },
          {
            "name": "SUSE-SR:2009:017",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
          },
          {
            "name": "macosx-smb-security-bypass(53174)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53174"
          },
          {
            "name": "oval:org.mitre.oval:def:7791",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7791"
          },
          {
            "name": "57955",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/57955"
          },
          {
            "name": "FEDORA-2009-10180",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-09-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "SSRT090212",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=126514298313071\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.4.2/"
        },
        {
          "name": "20091112 rPSA-2009-0145-1 samba samba-client samba-server samba-swat",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507856/100/0/threaded"
        },
        {
          "name": "FEDORA-2009-10172",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
        },
        {
          "name": "oval:org.mitre.oval:def:9191",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9191"
        },
        {
          "name": "HPSBUX02479",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=126514298313071\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.2.15/"
        },
        {
          "name": "APPLE-SA-2009-09-10-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html"
        },
        {
          "name": "1021111",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021111.1-1"
        },
        {
          "name": "ADV-2009-2810",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2810"
        },
        {
          "name": "SSA:2009-276-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
        },
        {
          "name": "37428",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37428"
        },
        {
          "name": "36937",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36937"
        },
        {
          "name": "USN-839-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-839-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.0.37/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.samba.org/samba/security/CVE-2009-2813.html"
        },
        {
          "name": "oval:org.mitre.oval:def:7257",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7257"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT3865"
        },
        {
          "name": "36363",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/36363"
        },
        {
          "name": "36918",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36918"
        },
        {
          "name": "36701",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36701"
        },
        {
          "name": "36893",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36893"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.3.8/"
        },
        {
          "name": "36953",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36953"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.rpath.com/Advisories:rPSA-2009-0145"
        },
        {
          "name": "oval:org.mitre.oval:def:7211",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7211"
        },
        {
          "name": "SUSE-SR:2009:017",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
        },
        {
          "name": "macosx-smb-security-bypass(53174)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53174"
        },
        {
          "name": "oval:org.mitre.oval:def:7791",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7791"
        },
        {
          "name": "57955",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/57955"
        },
        {
          "name": "FEDORA-2009-10180",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2813",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SSRT090212",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=126514298313071\u0026w=2"
            },
            {
              "name": "http://news.samba.org/releases/3.4.2/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.4.2/"
            },
            {
              "name": "20091112 rPSA-2009-0145-1 samba samba-client samba-server samba-swat",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507856/100/0/threaded"
            },
            {
              "name": "FEDORA-2009-10172",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
            },
            {
              "name": "oval:org.mitre.oval:def:9191",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9191"
            },
            {
              "name": "HPSBUX02479",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=126514298313071\u0026w=2"
            },
            {
              "name": "http://news.samba.org/releases/3.2.15/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.2.15/"
            },
            {
              "name": "APPLE-SA-2009-09-10-2",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html"
            },
            {
              "name": "1021111",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021111.1-1"
            },
            {
              "name": "ADV-2009-2810",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2810"
            },
            {
              "name": "SSA:2009-276-01",
              "refsource": "SLACKWARE",
              "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
            },
            {
              "name": "37428",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37428"
            },
            {
              "name": "36937",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36937"
            },
            {
              "name": "USN-839-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-839-1"
            },
            {
              "name": "http://news.samba.org/releases/3.0.37/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.0.37/"
            },
            {
              "name": "http://www.samba.org/samba/security/CVE-2009-2813.html",
              "refsource": "CONFIRM",
              "url": "http://www.samba.org/samba/security/CVE-2009-2813.html"
            },
            {
              "name": "oval:org.mitre.oval:def:7257",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7257"
            },
            {
              "name": "http://support.apple.com/kb/HT3865",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT3865"
            },
            {
              "name": "36363",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/36363"
            },
            {
              "name": "36918",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36918"
            },
            {
              "name": "36701",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36701"
            },
            {
              "name": "36893",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36893"
            },
            {
              "name": "http://news.samba.org/releases/3.3.8/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.3.8/"
            },
            {
              "name": "36953",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36953"
            },
            {
              "name": "http://wiki.rpath.com/Advisories:rPSA-2009-0145",
              "refsource": "CONFIRM",
              "url": "http://wiki.rpath.com/Advisories:rPSA-2009-0145"
            },
            {
              "name": "oval:org.mitre.oval:def:7211",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7211"
            },
            {
              "name": "SUSE-SR:2009:017",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
            },
            {
              "name": "macosx-smb-security-bypass(53174)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53174"
            },
            {
              "name": "oval:org.mitre.oval:def:7791",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7791"
            },
            {
              "name": "57955",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/57955"
            },
            {
              "name": "FEDORA-2009-10180",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2813",
    "datePublished": "2009-09-14T16:00:00.000Z",
    "dateReserved": "2009-08-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T06:07:36.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-2906 (GCVE-0-2009-2906)

Vulnerability from cvelistv5 – Published: 2009-10-07 18:00 – Updated: 2024-08-07 06:07

Summary

smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

27 references

URL	Tags
http://samba.org/samba/security/CVE-2009-2906.html	x_refsource_CONFIRM
http://news.samba.org/releases/3.4.2/	x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/507856/100…	mailing-listx_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://news.samba.org/releases/3.2.15/	x_refsource_CONFIRM
http://sunsolve.sun.com/search/document.do?assetk…	vendor-advisoryx_refsource_SUNALERT
http://osvdb.org/58519	vdb-entryx_refsource_OSVDB
http://www.vupen.com/english/advisories/2009/2810	vdb-entryx_refsource_VUPEN
http://slackware.com/security/viewer.php?l=slackw…	vendor-advisoryx_refsource_SLACKWARE
http://secunia.com/advisories/37428	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36937	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-839-1	vendor-advisoryx_refsource_UBUNTU
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://support.apple.com/kb/HT4077	x_refsource_CONFIRM
http://www.securityfocus.com/bid/36573	vdb-entryx_refsource_BID
http://news.samba.org/releases/3.0.37/	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://secunia.com/advisories/36918	third-party-advisoryx_refsource_SECUNIA
http://www.securitytracker.com/id?1022976	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/36893	third-party-advisoryx_refsource_SECUNIA
http://news.samba.org/releases/3.3.8/	x_refsource_CONFIRM
http://secunia.com/advisories/36953	third-party-advisoryx_refsource_SECUNIA
http://wiki.rpath.com/Advisories:rPSA-2009-0145	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA

Date Public

2009-10-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T06:07:37.199Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://samba.org/samba/security/CVE-2009-2906.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.4.2/"
          },
          {
            "name": "20091112 rPSA-2009-0145-1 samba samba-client samba-server samba-swat",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507856/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:9944",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9944"
          },
          {
            "name": "FEDORA-2009-10172",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
          },
          {
            "name": "APPLE-SA-2010-03-29-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.2.15/"
          },
          {
            "name": "1021111",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021111.1-1"
          },
          {
            "name": "58519",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/58519"
          },
          {
            "name": "ADV-2009-2810",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2810"
          },
          {
            "name": "SSA:2009-276-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
          },
          {
            "name": "37428",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37428"
          },
          {
            "name": "36937",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36937"
          },
          {
            "name": "USN-839-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-839-1"
          },
          {
            "name": "samba-smb-dos(53575)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53575"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4077"
          },
          {
            "name": "36573",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/36573"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.0.37/"
          },
          {
            "name": "oval:org.mitre.oval:def:7090",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7090"
          },
          {
            "name": "36918",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36918"
          },
          {
            "name": "1022976",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022976"
          },
          {
            "name": "36893",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36893"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.3.8/"
          },
          {
            "name": "36953",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36953"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.rpath.com/Advisories:rPSA-2009-0145"
          },
          {
            "name": "SUSE-SR:2009:017",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
          },
          {
            "name": "FEDORA-2009-10180",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://samba.org/samba/security/CVE-2009-2906.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.4.2/"
        },
        {
          "name": "20091112 rPSA-2009-0145-1 samba samba-client samba-server samba-swat",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507856/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:9944",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9944"
        },
        {
          "name": "FEDORA-2009-10172",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
        },
        {
          "name": "APPLE-SA-2010-03-29-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.2.15/"
        },
        {
          "name": "1021111",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021111.1-1"
        },
        {
          "name": "58519",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/58519"
        },
        {
          "name": "ADV-2009-2810",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2810"
        },
        {
          "name": "SSA:2009-276-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
        },
        {
          "name": "37428",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37428"
        },
        {
          "name": "36937",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36937"
        },
        {
          "name": "USN-839-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-839-1"
        },
        {
          "name": "samba-smb-dos(53575)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53575"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4077"
        },
        {
          "name": "36573",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/36573"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.0.37/"
        },
        {
          "name": "oval:org.mitre.oval:def:7090",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7090"
        },
        {
          "name": "36918",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36918"
        },
        {
          "name": "1022976",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022976"
        },
        {
          "name": "36893",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36893"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.3.8/"
        },
        {
          "name": "36953",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36953"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.rpath.com/Advisories:rPSA-2009-0145"
        },
        {
          "name": "SUSE-SR:2009:017",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
        },
        {
          "name": "FEDORA-2009-10180",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-2906",
    "datePublished": "2009-10-07T18:00:00.000Z",
    "dateReserved": "2009-08-20T00:00:00.000Z",
    "dateUpdated": "2024-08-07T06:07:37.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-2948 (GCVE-0-2009-2948)

Vulnerability from cvelistv5 – Published: 2009-10-07 18:00 – Updated: 2024-08-07 06:07

Summary

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

21 references

URL	Tags
http://www.samba.org/samba/security/CVE-2009-2948.html	x_refsource_CONFIRM
http://news.samba.org/releases/3.4.2/	x_refsource_CONFIRM
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://osvdb.org/58520	vdb-entryx_refsource_OSVDB
http://www.securitytracker.com/id?1022975	vdb-entryx_refsource_SECTRACK
http://news.samba.org/releases/3.2.15/	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.securityfocus.com/bid/36572	vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2009/2810	vdb-entryx_refsource_VUPEN
http://slackware.com/security/viewer.php?l=slackw…	vendor-advisoryx_refsource_SLACKWARE
http://secunia.com/advisories/36937	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-839-1	vendor-advisoryx_refsource_UBUNTU
http://news.samba.org/releases/3.0.37/	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://secunia.com/advisories/36918	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36893	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://news.samba.org/releases/3.3.8/	x_refsource_CONFIRM
http://secunia.com/advisories/36953	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA

Date Public

2009-10-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T06:07:37.340Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.samba.org/samba/security/CVE-2009-2948.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.4.2/"
          },
          {
            "name": "FEDORA-2009-10172",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
          },
          {
            "name": "58520",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/58520"
          },
          {
            "name": "1022975",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022975"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.2.15/"
          },
          {
            "name": "oval:org.mitre.oval:def:7087",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087"
          },
          {
            "name": "36572",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/36572"
          },
          {
            "name": "ADV-2009-2810",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2810"
          },
          {
            "name": "SSA:2009-276-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
          },
          {
            "name": "36937",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36937"
          },
          {
            "name": "USN-839-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-839-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.0.37/"
          },
          {
            "name": "oval:org.mitre.oval:def:10434",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434"
          },
          {
            "name": "36918",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36918"
          },
          {
            "name": "36893",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36893"
          },
          {
            "name": "samba-mountcifs-info-disclosure(53574)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53574"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://news.samba.org/releases/3.3.8/"
          },
          {
            "name": "36953",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36953"
          },
          {
            "name": "SUSE-SR:2009:017",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
          },
          {
            "name": "FEDORA-2009-10180",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.samba.org/samba/security/CVE-2009-2948.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.4.2/"
        },
        {
          "name": "FEDORA-2009-10172",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
        },
        {
          "name": "58520",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/58520"
        },
        {
          "name": "1022975",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022975"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.2.15/"
        },
        {
          "name": "oval:org.mitre.oval:def:7087",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087"
        },
        {
          "name": "36572",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/36572"
        },
        {
          "name": "ADV-2009-2810",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2810"
        },
        {
          "name": "SSA:2009-276-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
        },
        {
          "name": "36937",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36937"
        },
        {
          "name": "USN-839-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-839-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.0.37/"
        },
        {
          "name": "oval:org.mitre.oval:def:10434",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434"
        },
        {
          "name": "36918",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36918"
        },
        {
          "name": "36893",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36893"
        },
        {
          "name": "samba-mountcifs-info-disclosure(53574)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53574"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://news.samba.org/releases/3.3.8/"
        },
        {
          "name": "36953",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36953"
        },
        {
          "name": "SUSE-SR:2009:017",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
        },
        {
          "name": "FEDORA-2009-10180",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2948",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.samba.org/samba/security/CVE-2009-2948.html",
              "refsource": "CONFIRM",
              "url": "http://www.samba.org/samba/security/CVE-2009-2948.html"
            },
            {
              "name": "http://news.samba.org/releases/3.4.2/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.4.2/"
            },
            {
              "name": "FEDORA-2009-10172",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html"
            },
            {
              "name": "58520",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/58520"
            },
            {
              "name": "1022975",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022975"
            },
            {
              "name": "http://news.samba.org/releases/3.2.15/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.2.15/"
            },
            {
              "name": "oval:org.mitre.oval:def:7087",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087"
            },
            {
              "name": "36572",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/36572"
            },
            {
              "name": "ADV-2009-2810",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2810"
            },
            {
              "name": "SSA:2009-276-01",
              "refsource": "SLACKWARE",
              "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.561439"
            },
            {
              "name": "36937",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36937"
            },
            {
              "name": "USN-839-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-839-1"
            },
            {
              "name": "http://news.samba.org/releases/3.0.37/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.0.37/"
            },
            {
              "name": "oval:org.mitre.oval:def:10434",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434"
            },
            {
              "name": "36918",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36918"
            },
            {
              "name": "36893",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36893"
            },
            {
              "name": "samba-mountcifs-info-disclosure(53574)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53574"
            },
            {
              "name": "http://news.samba.org/releases/3.3.8/",
              "refsource": "CONFIRM",
              "url": "http://news.samba.org/releases/3.3.8/"
            },
            {
              "name": "36953",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36953"
            },
            {
              "name": "SUSE-SR:2009:017",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
            },
            {
              "name": "FEDORA-2009-10180",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2948",
    "datePublished": "2009-10-07T18:00:00.000Z",
    "dateReserved": "2009-08-23T00:00:00.000Z",
    "dateUpdated": "2024-08-07T06:07:37.340Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2015-01184 (CVE-2009-2813)

CVE-2009-2813 (GCVE-0-2009-2813)

CVE-2009-2906 (GCVE-0-2009-2906)

CVE-2009-2948 (GCVE-0-2009-2948)

Tags

Sightings

Nomenclature

Related by attack behaviour