CVE-2015-7560

Опубликовано: 13 мар. 2016

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html
Mailing List
Third Party Advisory
http://www.debian.org/security/2016/dsa-3514
Third Party Advisory
http://www.securityfocus.com/bid/84267
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035220
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2922-1
Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=11648
Issue Tracking
Vendor Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842
Third Party Advisory
https://www.samba.org/samba/security/CVE-2015-7560.html
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 3.2.0 (включая) до 4.1.23 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.2.0 (включая) до 4.2.9 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.3.0 (включая) до 4.3.6 (исключая)

cpe:2.3:a:samba:samba:4.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.4.0:rc2:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.4.0:rc3:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.04074

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-284

Связанные уязвимости

CVE-2015-7560

CVSS3: 6.5

ubuntu

больше 9 лет назад

CVE-2015-7560

redhat

больше 9 лет назад

CVE-2015-7560

CVSS3: 6.5

debian

больше 9 лет назад

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4. ...

openSUSE-SU-2016:0877-1

suse-cvrf

больше 9 лет назад

Security update for samba

SUSE-SU-2016:0905-1

suse-cvrf

больше 9 лет назад

Security update for samba

EPSS

Процентиль: 88%

0.04074

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-284