CVE-2015-5252

Опубликовано: 29 дек. 2015

Источник: nvd

CVSS3: 7.2

CVSS2: 5

EPSS Средний

Описание

vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00002.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00046.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html
Mailing List
Third Party Advisory
http://www.debian.org/security/2016/dsa-3433
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Third Party Advisory
http://www.securityfocus.com/bid/79733
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034493
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2855-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-2855-2
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1290288
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 4.1.22 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.2.0 (включая) до 4.2.7 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.3.0 (включая) до 4.3.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.15999

Средний

7.2 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2015-5252

CVSS3: 7.2

ubuntu

больше 9 лет назад

CVE-2015-5252

redhat

больше 9 лет назад

CVE-2015-5252

CVSS3: 7.2

debian

больше 9 лет назад

vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, ...

GHSA-v8hr-9qpr-jrwc

CVSS3: 7.2

github

больше 3 лет назад

BDU:2021-01277

CVSS3: 7.2

fstec

больше 9 лет назад

Уязвимость библиотеки smbd пакета программ сетевого взаимодействия Samba, связанная с недостатком механизма контроля привилегий и средств управления доступом, позволяющая нарушителю оказать воздействие на целостность данных

EPSS

Процентиль: 95%

0.15999

Средний

7.2 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-264