CVE-2009-2948

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
1.9 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
sambasamba
3.0.0 ≤
𝑥
< 3.0.37
sambasamba
3.2.0 ≤
𝑥
< 3.2.15
sambasamba
3.3.0 ≤
𝑥
< 3.3.8
sambasamba
3.4.0 ≤
𝑥
< 3.4.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
samba
bullseye (security)
2:4.13.13+dfsg-1~deb11u6
fixed
bullseye
2:4.13.13+dfsg-1~deb11u6
fixed
bookworm
2:4.17.12+dfsg-0+deb12u1
fixed
bookworm (security)
2:4.17.12+dfsg-0+deb12u1
fixed
sid
2:4.21.1+dfsg-2
fixed
trixie
2:4.21.1+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
samba
jaunty
Fixed 2:3.3.2-1ubuntu3.2
released
intrepid
Fixed 2:3.2.3-1ubuntu3.6
released
hardy
Fixed 3.0.28a-1ubuntu4.9
released
dapper
Fixed 3.0.22-1ubuntu3.9
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://news.samba.org/releases/3.0.37/
http://news.samba.org/releases/3.2.15/
http://news.samba.org/releases/3.3.8/
http://news.samba.org/releases/3.4.2/
http://osvdb.org/58520
http://secunia.com/advisories/36893
http://secunia.com/advisories/36918
http://secunia.com/advisories/36937
http://secunia.com/advisories/36953
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439
http://www.samba.org/samba/security/CVE-2009-2948.html
http://www.securityfocus.com/bid/36572
http://www.securitytracker.com/id?1022975
http://www.ubuntu.com/usn/USN-839-1
http://www.vupen.com/english/advisories/2009/2810
https://exchange.xforce.ibmcloud.com/vulnerabilities/53574
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://news.samba.org/releases/3.0.37/
http://news.samba.org/releases/3.2.15/
http://news.samba.org/releases/3.3.8/
http://news.samba.org/releases/3.4.2/
http://osvdb.org/58520
http://secunia.com/advisories/36893
http://secunia.com/advisories/36918
http://secunia.com/advisories/36937
http://secunia.com/advisories/36953
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439
http://www.samba.org/samba/security/CVE-2009-2948.html
http://www.securityfocus.com/bid/36572
http://www.securitytracker.com/id?1022975
http://www.ubuntu.com/usn/USN-839-1
http://www.vupen.com/english/advisories/2009/2810
https://exchange.xforce.ibmcloud.com/vulnerabilities/53574
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html