PT-2013-1324 · Samba+4 · Samba+4

Hemanth Thummala · Published 2013-11-12 · Updated 2024-06-15 · CVE-2013-4475

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Samba versions 3.2.x through 3.6.x before 3.6.20 Samba versions 4.0.x before 4.0.11 Samba versions 4.1.x before 4.1.1

Description The issue is related to a lack of privilege control and access management mechanisms in the vfs streams depot or vfs streams xattr functions of Samba network interaction programs. This can allow a remote attacker to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS), potentially gaining access to confidential data and compromising its integrity.

Recommendations For Samba versions 3.2.x through 3.6.x before 3.6.20, update to version 3.6.20 or later. For Samba versions 4.0.x before 4.0.11, update to version 4.0.11 or later. For Samba versions 4.1.x before 4.1.1, update to version 4.1.1 or later. As a temporary workaround, consider disabling the vfs streams depot and vfs streams xattr functions until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2013-1099

BDU:2021-01278

CESA-2013_1806

CVE-2013-4475

DSA-2812-1

ECHO-B78D-D090-F185

MGASA-2013-0348

OPENSUSE-SU-2024:10069-1

RHSA-2013:1806

RHSA-2013_1806

RHSA-2014:0009

SUSE-SU-2014_0839-1

SUSE-SU-2015:0386-1

USN-2054-1

Affected Products

Alt Linux

Centos

Red Hat

Samba

Suse

References · 90

• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01278 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-1806.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00083.html · Vendor Advisory
• http://debian.org/security/2013/dsa-2812 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2054-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4475 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4475 · Security Note
• http://security.gentoo.org/glsa/glsa-201502-15.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4475 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0348.html · Security Note
• https://ubuntu.com/security/CVE-2013-4475 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4475 · Vendor Advisory
• http://samba.org/samba/security/CVE-2013-4475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4475 · Security Note