CVE-2013-0454

26.03.2013, 21:55

The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:S/C:N/I:P/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 86.19%

Affected Products (NVD)

Vendor	Product	Version
canonical	ubuntu_linux	12.04
samba	samba	𝑥 ≤ 3.6.5
samba	samba	3.6.0
samba	samba	3.6.1
samba	samba	3.6.2
samba	samba	3.6.3
samba	samba	3.6.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

samba

bookworm	2:4.17.12+dfsg-0+deb12u1 fixed
bookworm (security)	2:4.17.12+dfsg-0+deb12u1 fixed
bullseye	2:4.13.13+dfsg-1~deb11u6 fixed
bullseye (security)	2:4.13.13+dfsg-1~deb11u6 fixed
sid	2:4.21.1+dfsg-2 fixed
squeeze	not-affected
trixie	2:4.21.1+dfsg-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

samba

hardy	not-affected
lucid	not-affected
oneiric	not-affected
precise	Fixed 2:3.6.3-2ubuntu2.6 released
quantal	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

libdcerpc-atsvc0

suse enterprise server 12 SP2

4.2.4-26.2

fixed

libdcerpc-binding0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libdcerpc-binding0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libdcerpc0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libdcerpc0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libgensec0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libgensec0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libndr-krb5pac0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-krb5pac0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-nbt0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-nbt0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-standard0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr-standard0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libndr0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libnetapi0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libnetapi0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libpdb0

suse enterprise server 12

4.1.12-3.2

fixed

libpdb0-32bit

suse enterprise server 12

4.1.12-3.2

fixed

libregistry0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libsamba-credentials0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-credentials0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-errors0

suse enterprise server 12 SP2

4.4.2-29.4

fixed

libsamba-errors0-32bit

suse enterprise server 12 SP2

4.4.2-29.4

fixed

libsamba-hostconfig0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-hostconfig0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-passdb0

suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-passdb0-32bit

suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-util0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamba-util0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamdb0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsamdb0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbclient-raw0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libsmbclient-raw0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

libsmbclient0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbclient0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbconf0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbconf0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbldap0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libsmbldap0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libtevent-util0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libtevent-util0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libwbclient0

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

libwbclient0-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed

samba-client

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-client-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-doc

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-libs

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-libs-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-winbind

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

samba-winbind-32bit

suse enterprise server 12	4.1.12-3.2 fixed
suse enterprise server 12 SP1	4.2.4-4.19 fixed
suse enterprise server 12 SP2	4.4.2-29.4 fixed

Common Weakness Enumeration

CWE-264 -

References

http://www.ibm.com/support/docview.wss?uid=ssg1S1004289

http://www.ubuntu.com/usn/USN-1802-1

https://bugzilla.redhat.com/show_bug.cgi?id=928419

https://bugzilla.samba.org/show_bug.cgi?id=8738

https://exchange.xforce.ibmcloud.com/vulnerabilities/80970

https://lists.samba.org/archive/samba-announce/2012/000259.html

https://www.samba.org/samba/security/CVE-2013-0454

http://www.ibm.com/support/docview.wss?uid=ssg1S1004289

http://www.ubuntu.com/usn/USN-1802-1

https://bugzilla.redhat.com/show_bug.cgi?id=928419

https://bugzilla.samba.org/show_bug.cgi?id=8738

https://exchange.xforce.ibmcloud.com/vulnerabilities/80970

https://lists.samba.org/archive/samba-announce/2012/000259.html

https://www.samba.org/samba/security/CVE-2013-0454