mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.
References
Configurations
Configuration 1 (hide)
|
History
31 Oct 2022, 15:03
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-732 | |
CPE | cpe:2.3:a:samba:samba:3.0.26a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.3.4:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.16:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.23b:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25:pre1:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.10:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.30:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.19:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.20a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.26:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.9:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.20b:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.4:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.8:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.33:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.7:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.27:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.5:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.21:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.31:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.13:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.24:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.22:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.29:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.14a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.21b:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25:rc3:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.21c:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.17:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.23a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.2:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.34:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.11:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.3:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.21a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.4:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25b:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25c:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25:rc2:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.12:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.9:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.23d:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.4:rc1:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.3.5:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.14:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.10:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.4:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25:pre2:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.5:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.11:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.25:rc1:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.32:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.23:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.28a:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.3:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.18:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.20:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.0.23c:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:3.2.3:*:*:*:*:*:*:* |
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* |
References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/53574 - Third Party Advisory, VDB Entry | |
References | (SECUNIA) http://secunia.com/advisories/36918 - Not Applicable, Vendor Advisory | |
References | (CONFIRM) http://news.samba.org/releases/3.3.8/ - Broken Link, Vendor Advisory | |
References | (CONFIRM) http://news.samba.org/releases/3.4.2/ - Broken Link, Vendor Advisory | |
References | (OSVDB) http://osvdb.org/58520 - Broken Link | |
References | (SUSE) http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html - Mailing List, Third Party Advisory | |
References | (FEDORA) https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html - Patch, Third Party Advisory | |
References | (BID) http://www.securityfocus.com/bid/36572 - Patch, Third Party Advisory, VDB Entry | |
References | (FEDORA) https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html - Patch, Third Party Advisory | |
References | (CONFIRM) http://news.samba.org/releases/3.0.37/ - Broken Link, Vendor Advisory | |
References | (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434 - Broken Link, Third Party Advisory | |
References | (SECUNIA) http://secunia.com/advisories/36953 - Not Applicable, Vendor Advisory | |
References | (UBUNTU) http://www.ubuntu.com/usn/USN-839-1 - Third Party Advisory | |
References | (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087 - Broken Link, Third Party Advisory | |
References | (CONFIRM) http://news.samba.org/releases/3.2.15/ - Broken Link, Vendor Advisory | |
References | (SECUNIA) http://secunia.com/advisories/36937 - Not Applicable, Vendor Advisory | |
References | (SLACKWARE) http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439 - Patch, Third Party Advisory | |
References | (VUPEN) http://www.vupen.com/english/advisories/2009/2810 - Permissions Required, Vendor Advisory | |
References | (SECUNIA) http://secunia.com/advisories/36893 - Not Applicable, Vendor Advisory | |
References | (SECTRACK) http://www.securitytracker.com/id?1022975 - Broken Link, Patch, Third Party Advisory, VDB Entry |
Information
Published : 2009-10-07 18:30
Updated : 2023-12-10 10:51
NVD link : CVE-2009-2948
Mitre link : CVE-2009-2948
CVE.ORG link : CVE-2009-2948
JSON object : View
Products Affected
samba
- samba
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource