CVE-2011-2522

29.07.2011, 20:55

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.

CSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.8 UNKNOWN	NETWORK	MEDIUM		AV:N/AC:M/Au:N/C:P/I:P/A:P

Base Score

CVSS 3.x

EPSS Score

Percentile: 95.28%

Affected Products (NVD)

Vendor	Product	Version
samba	samba	3.0.0 ≤ 𝑥 < 3.3.16
samba	samba	3.4.0 ≤ 𝑥 < 3.4.14
samba	samba	3.5.0 ≤ 𝑥 < 3.5.10
debian	debian_linux	5.0
debian	debian_linux	6.0
debian	debian_linux	7.0
canonical	ubuntu_linux	8.04
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	10.10
canonical	ubuntu_linux	11.04

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

samba

bookworm	2:4.17.12+dfsg-0+deb12u1 fixed
bookworm (security)	2:4.17.12+dfsg-0+deb12u1 fixed
bullseye	2:4.13.13+dfsg-1~deb11u6 fixed
bullseye (security)	2:4.13.13+dfsg-1~deb11u6 fixed
sid	2:4.21.1+dfsg-2 fixed
trixie	2:4.21.1+dfsg-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

samba

hardy	Fixed 3.0.28a-1ubuntu4.15 released
lucid	Fixed 2:3.4.7~dfsg-1ubuntu3.7 released
maverick	Fixed 2:3.5.4~dfsg-1ubuntu8.5 released
natty	Fixed 2:3.5.8~dfsg-1ubuntu2.3 released

openSUSE / SLES Releases

openSUSE Product

Release

libdcerpc-atsvc0

suse enterprise server 12 SP2

4.2.4-26.2

fixed

libdcerpc-binding0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libdcerpc-binding0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libdcerpc0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libdcerpc0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libgensec0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libgensec0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libndr-krb5pac0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-krb5pac0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-nbt0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-nbt0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-standard0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-standard0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libnetapi0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libnetapi0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libpdb0

suse enterprise server 12

4.1.12-3.2

fixed

libpdb0-32bit

suse enterprise server 12

4.1.12-3.2

fixed

libregistry0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libsamba-credentials0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-credentials0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-errors0

suse enterprise server 12 SP2

4.4.2-29.4

fixed

libsamba-errors0-32bit

suse enterprise server 12 SP2

4.4.2-29.4

fixed

libsamba-hostconfig0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-hostconfig0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-passdb0

suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-passdb0-32bit

suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-util0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-util0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamdb0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamdb0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbclient-raw0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libsmbclient-raw0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libsmbclient0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbclient0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbconf0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbconf0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbldap0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbldap0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libtevent-util0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libtevent-util0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libwbclient0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libwbclient0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

samba-client

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-client-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-doc

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-libs

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-libs-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-winbind

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-winbind-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

cifs-utils

RHEL 6

0:4.8.1-2.el6_1.2

fixed

libsmbclient

RHEL 6

0:3.5.6-86.el6_1.4

fixed

libsmbclient-devel

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-client

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-common

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-doc

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-domainjoin-gui

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-swat

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-winbind

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-winbind-clients

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-winbind-devel

RHEL 6

0:3.5.6-86.el6_1.4

fixed

samba-winbind-krb5-locator

RHEL 6

0:3.5.6-86.el6_1.4

fixed

Known Exploits!

Common Weakness Enumeration

CWE-352 - Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References

http://jvn.jp/en/jp/JVN29529126/index.html

http://marc.info/?l=bugtraq&m=133527864025056&w=2

http://osvdb.org/74071

http://samba.org/samba/history/samba-3.5.10.html

http://secunia.com/advisories/45393

http://secunia.com/advisories/45488

http://secunia.com/advisories/45496

http://securityreason.com/securityalert/8317

http://securitytracker.com/id?1025852

http://ubuntu.com/usn/usn-1182-1

http://www.debian.org/security/2011/dsa-2290

http://www.exploit-db.com/exploits/17577

http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543

http://www.mandriva.com/security/advisories?name=MDVSA-2011:121

http://www.samba.org/samba/security/CVE-2011-2522

http://www.securityfocus.com/bid/48899

https://bugzilla.redhat.com/show_bug.cgi?id=721348

https://bugzilla.samba.org/show_bug.cgi?id=8290

https://exchange.xforce.ibmcloud.com/vulnerabilities/68843

http://jvn.jp/en/jp/JVN29529126/index.html

http://marc.info/?l=bugtraq&m=133527864025056&w=2

http://osvdb.org/74071

http://samba.org/samba/history/samba-3.5.10.html

http://secunia.com/advisories/45393

http://secunia.com/advisories/45488

http://secunia.com/advisories/45496

http://securityreason.com/securityalert/8317

http://securitytracker.com/id?1025852

http://ubuntu.com/usn/usn-1182-1

http://www.debian.org/security/2011/dsa-2290

http://www.exploit-db.com/exploits/17577

http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543

http://www.mandriva.com/security/advisories?name=MDVSA-2011:121

http://www.samba.org/samba/security/CVE-2011-2522

http://www.securityfocus.com/bid/48899

https://bugzilla.redhat.com/show_bug.cgi?id=721348

https://bugzilla.samba.org/show_bug.cgi?id=8290

https://exchange.xforce.ibmcloud.com/vulnerabilities/68843