CVE-2013-4475

Опубликовано: 13 нояб. 2013

Источник: nvd

CVSS2: 4

EPSS Низкий

Описание

Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00002.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00083.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00115.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00117.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.html
Mailing List
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1806.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0009.html
Third Party Advisory
http://secunia.com/advisories/56508
Third Party Advisory
http://security.gentoo.org/glsa/glsa-201502-15.xml
Third Party Advisory
http://www.debian.org/security/2013/dsa-2812
Third Party Advisory
http://www.samba.org/samba/history/samba-3.6.20.html
Vendor Advisory
http://www.samba.org/samba/history/samba-4.0.11.html
Vendor Advisory
http://www.samba.org/samba/history/samba-4.1.1.html
Vendor Advisory
http://www.samba.org/samba/security/CVE-2013-4475
Vendor Advisory
http://www.securityfocus.com/bid/63646
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2054-1
Third Party Advisory
https://blogs.oracle.com/sunsecurity/entry/cve_2013_4475_access_control
Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 3.2.0 (включая) до 3.6.20 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.0.11 (исключая)

cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06758

Низкий

4 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2013-4475

ubuntu

почти 12 лет назад

CVE-2013-4475

redhat

почти 12 лет назад

CVE-2013-4475

debian

почти 12 лет назад

Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1. ...

GHSA-rhf5-jmh4-q5rv

github

около 3 лет назад

BDU:2021-01278

CVSS3: 5.4

fstec

почти 12 лет назад

Уязвимость функции vfs_streams_depot or vfs_streams_xattr пакета программ сетевого взаимодействия Samba, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность

EPSS

Процентиль: 91%

0.06758

Низкий

4 Medium

CVSS2

Дефекты

CWE-264