PT-2013-1044 · Samba · Samba

Ricky Nance · Published 2013-03-19 · Updated 2024-06-15 · CVE-2013-1863

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Samba versions 4.x before 4.0.4

Description The issue exists in Samba when configured as an Active Directory domain controller, where non-default CIFS shares have world-writable permissions. This allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.

Recommendations For Samba versions 4.x before 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting write access to non-default CIFS shares to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-00387

CVE-2013-1863

OPENSUSE-SU-2024:10069-1

Affected Products

Samba

References · 62

• http://samba.org/samba/security/CVE-2013-1863 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00387 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1863 · Security Note
• http://samba.org/samba/ftp/patches/security/samba-4.0.3-CVE-2013-1863.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-1863 · Security Note
• https://suse.com/security/cve/CVE-2013-0172 · Note
• https://suse.com/security/cve/CVE-2013-0213 · Note
• https://suse.com/security/cve/CVE-2016-2115 · Note
• https://suse.com/security/cve/CVE-2014-0239 · Note
• https://suse.com/security/cve/CVE-2009-2813 · Note
• https://suse.com/security/cve/CVE-2013-4496 · Note
• https://suse.com/security/cve/CVE-2011-2694 · Note
• https://suse.com/security/cve/CVE-2015-7560 · Note
• https://suse.com/security/cve/CVE-2016-2118 · Note