PT-2014-1430 · Samba+3 · Samba+3

Noel Power · Published 2014-03-14 · Updated 2024-06-15 · CVE-2013-6442

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Samba versions 4.0.x through 4.0.15 Samba versions 4.1.x through 4.1.5

Description The issue exists in the owner set function in smbcacls.c in smbcacls due to the removal of an access control list when using the --chown or --chgrp options. This allows remote attackers to bypass intended access restrictions by leveraging an unintended administrative change. The vulnerability can lead to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For Samba versions 4.0.x through 4.0.15, update to version 4.0.16 or later. For Samba versions 4.1.x through 4.1.5, update to version 4.1.6 or later. As a temporary workaround, consider restricting the use of the --chown and --chgrp options in smbcacls until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-264

CWE-20

Related Identifiers

ALT-PU-2014-1308

BDU:2015-00389

BDU:2015-06049

BDU:2015-08932

CESA-2014_0383

CVE-2013-6442

ECHO-37BB-8A91-8334

OPENSUSE-SU-2024:10069-1

RHSA-2014:0383

RHSA-2014_0383

Affected Products

Alt Linux

Centos

Red Hat

Samba

References · 80

• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6442 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6442 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0383.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6442 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6442 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6442 · Security Note
• https://bdu.fstec.ru/vul/2015-06049 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6442 · Security Note
• https://bdu.fstec.ru/vul/2015-08932 · Security Note
• https://ubuntu.com/security/CVE-2013-6442 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00389 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-6442 · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-03/msg00062.html · Vendor Advisory