CVE-2009-2948
First published: Wed Oct 07 2009(Updated: )
mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Samba | >=3.4.0<3.4.2 | |
| Samba | >=3.3.0<3.3.8 | |
| Samba | >=3.2.0<3.2.15 | |
| Samba | >=3.0.0<3.0.37 |
Remedy
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.ubuntu.com/usn/USN-839-1
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439
- http://secunia.com/advisories/36918
- http://secunia.com/advisories/36953
- http://www.vupen.com/english/advisories/2009/2810
- http://secunia.com/advisories/36937
- http://www.samba.org/samba/security/CVE-2009-2948.html
- http://secunia.com/advisories/36893
- http://osvdb.org/58520
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html
- http://www.securitytracker.com/id?1022975
- http://www.securityfocus.com/bid/36572
- http://news.samba.org/releases/3.3.8/
- http://news.samba.org/releases/3.4.2/
- http://news.samba.org/releases/3.2.15/
- http://news.samba.org/releases/3.0.37/
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53574
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/samba
- canonical/samba
- version/samba/3.4.0
- version/samba/3.3.0
- version/samba/3.2.0
- version/samba/3.0.0