CVE-2015-7560

Опубликовано: 13 мар. 2016

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html
Mailing List
Third Party Advisory
http://www.debian.org/security/2016/dsa-3514
Third Party Advisory
http://www.securityfocus.com/bid/84267
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035220
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2922-1
Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=11648
Issue Tracking
Vendor Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842
Third Party Advisory
https://www.samba.org/samba/security/CVE-2015-7560.html
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 3.2.0 (включая) до 4.1.23 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.2.0 (включая) до 4.2.9 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.3.0 (включая) до 4.3.6 (исключая)

cpe:2.3:a:samba:samba:4.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.4.0:rc2:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.4.0:rc3:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.03692

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-284

Связанные уязвимости

CVE-2015-7560

CVSS3: 6.5

ubuntu

почти 10 лет назад

CVE-2015-7560

redhat

почти 10 лет назад

CVE-2015-7560

CVSS3: 6.5

debian

почти 10 лет назад

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4. ...

openSUSE-SU-2016:0877-1

suse-cvrf

почти 10 лет назад

Security update for samba

SUSE-SU-2016:0905-1

suse-cvrf

почти 10 лет назад

Security update for samba

EPSS

Процентиль: 88%

0.03692

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-284