PT-2006-2093 · Samba · Samba

Publicado 2006-03-30 · Atualizado 2024-06-15 · CVE-2006-1059

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samba versions 3.0.21 through 3.0.21c

Description The issue allows local users to obtain the machine trust account password and spoof the server in the domain. This is due to the winbindd daemon writing the machine trust account password in cleartext in log files. Local attackers can gain access to the machine trust account of affected computers, potentially impersonating the affected server in the domain and gaining access to sensitive information, including users and groups. Successful exploitation requires the log level to be set to 5 or above.

Recommendations For Samba versions 3.0.21 through 3.0.21c, consider disabling the winbindd daemon or restricting access to the log files until a fix is available. Additionally, set the log level to a value below 5 to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1059

OPENSUSE-SU-2024:10683-1

OPENSUSE-SU-2024:11365-1

Produtos afetados

Samba

Referências · 87

• https://suse.com/security/cve/CVE-2020-14383 · Nota
• https://suse.com/security/cve/CVE-2020-27840 · Nota
• https://suse.com/security/cve/CVE-2020-10700 · Nota
• https://suse.com/security/cve/CVE-2019-14870 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:11365-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-4138 · Nota
• http://us1.samba.org/samba/security/CAN-2006-1059.html · Correção
• https://suse.com/security/cve/CVE-2017-15275 · Nota
• https://suse.com/security/cve/CVE-2016-2125 · Nota
• https://suse.com/security/cve/CVE-2019-10218 · Nota
• https://suse.com/security/cve/CVE-2017-12163 · Nota
• https://suse.com/security/cve/CVE-2020-10730 · Nota
• http://secunia.com/advisories/19539 · Nota
• https://suse.com/security/cve/CVE-2017-12150 · Nota
• https://suse.com/security/cve/CVE-2018-16851 · Nota