PT-2009-4351 · Samba+1 · Samba+1

Jeremy Allison · Published 2009-06-24 · Updated 2024-06-15 · CVE-2009-1888

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Samba versions 3.0.x through 3.0.34 Samba versions 3.1.x through 3.2.12 Samba versions 3.3.x through 3.3.5

Description: The issue allows remote attackers to modify access control lists for files. This is related to read access to uninitialized memory when dos filemode is enabled.

Recommendations: For Samba versions 3.0.x through 3.0.34, update to version 3.0.35 or later. For Samba versions 3.1.x through 3.2.12, update to version 3.2.13 or later. For Samba versions 3.3.x through 3.3.5, update to version 3.3.6 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1888

DSA-1823-1

ECHO-0C92-D457-D9F2

OPENSUSE-SU-2024:10069-1

OPENSUSE-SU-2024:10334-1

RHSA-2009:1529

RHSA-2009:1585

RHSA-2009_1529

Affected Products

Red Hat

Samba

References · 83

• 🔥 http://securityfocus.com/bid/35472 · Exploit
• 🔥 http://samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1888 · Vendor Advisory
• http://samba.org/samba/security/CVE-2009-1888.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1823 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-1888 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10334-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1888 · Security Note
• http://samba.org/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 · Vendor Advisory
• http://ubuntu.com/usn/USN-839-1 · Vendor Advisory
• http://samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1888 · Vendor Advisory