PT-2009-6647 · Samba+2 · Samba+2

J. David Hester · Published 1970-01-01 · Updated 2024-06-15 · CVE-2009-2813

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Samba versions 3.0.12 through 3.0.36 Samba versions 3.2 through 3.2.15 Samba versions 3.3 through 3.3.8 Samba versions 3.4 through 3.4.2

Description The issue allows remote authenticated users to bypass intended sharing restrictions and read, create, or modify files in certain circumstances involving user accounts that lack home directories. This is due to improper handling of errors in resolving pathnames. The vulnerability can be exploited by a remote attacker who has passed the authentication procedure.

Recommendations For Samba versions 3.0.12 through 3.0.36, update to version 3.0.37 or later. For Samba versions 3.2 through 3.2.15, update to version 3.2.16 or later. For Samba versions 3.3 through 3.3.8, update to version 3.3.9 or later. For Samba versions 3.4 through 3.4.2, update to version 3.4.3 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-01177

BDU:2015-01178

BDU:2015-01179

BDU:2015-01181

BDU:2015-01182

BDU:2015-01183

BDU:2015-01184

BDU:2015-01185

BDU:2015-02091

BDU:2015-02553

BDU:2015-02895

BDU:2015-02896

CVE-2009-2813

DSA-1908-1

ECHO-047B-3C85-5DE4

HPSBUX02479

OPENSUSE-SU-2024:10069-1

OPENSUSE-SU-2024:10334-1

RHSA-2009:1529

RHSA-2009:1585

RHSA-2009_1529

Affected Products

Hp-Ux

Red Hat

Samba

References · 109

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2948 · Security Note
• http://secunia.com/advisories/37428 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• http://secunia.com/advisories/36918 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=126514298313071&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2813 · Security Note
• https://bdu.fstec.ru/vul/2015-02896 · Security Note
• https://bdu.fstec.ru/vul/2015-01185 · Security Note
• https://osv.dev/vulnerability/CVE-2009-2813 · Vendor Advisory
• http://secunia.com/advisories/36893 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01183 · Security Note
• http://vupen.com/english/advisories/2009/2810 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01177 · Security Note
• http://samba.org/samba/security/CVE-2009-2813.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2813 · Security Note