PT-2009-4350 · Samba Team+1 · Samba

Jeremy Allison + 1 · Published 2009-06-23 · Updated 2024-06-15 · CVE-2009-1886

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Samba versions 3.2.0 through 3.2.12

Description: The issue is related to multiple format string vulnerabilities in the client/client.c file of smbclient. These vulnerabilities might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.

Recommendations: For Samba versions 3.2.0 through 3.2.12, update to a version outside of this range to mitigate the risk of exploitation.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2009-1886

DSA-1823-1

ECHO-D41B-B5A4-6D7C

OPENSUSE-SU-2024:10069-1

OPENSUSE-SU-2024:10334-1

Affected Products

Samba

References · 79

• 🔥 https://exploit-db.com/exploits/33053 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:196 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1664 · Vendor Advisory
• http://debian.org/security/2009/dsa-1823 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10334-1 · Vendor Advisory
• http://samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1886.patch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1886 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-1886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1886 · Security Note
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 · Vendor Advisory
• http://securityfocus.com/bid/35472 · Patch
• http://ubuntu.com/usn/USN-839-1 · Vendor Advisory
• http://secunia.com/advisories/35539 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1886 · Vendor Advisory