CVE-2011-2522: CSRF
It was found that the different user screens (HTML forms) of the Samba Web Administration Tool suite were missing protection against cross-site request forgery (CSRF) attacks. A remote attacker could provide a specially-crafted URL, which once visited by an authenticated Samba SWAT user could lead to unauthorized commands execution with the privileges of that user (for example shut down or start the samba daemons, add or remove shares, printers, user accounts if the victim authenticated as privileged user to Samba SWAT).
Upstream bug report: [1] https://bugzilla.samba.org/showbug.cgi?id=8290 (not public yet)
Acknowledgements:
Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter.
Other sources
Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2522?
CVE-2011-2522 is considered a moderate severity vulnerability due to its potential for cross-site request forgery attacks.
How do I fix CVE-2011-2522?
To mitigate CVE-2011-2522, you should upgrade Samba to version 3.5.10 or later.
What types of systems are affected by CVE-2011-2522?
CVE-2011-2522 affects various versions of Samba, particularly those prior to 3.5.10 and specific Debian and Ubuntu versions.
Can CVE-2011-2522 be exploited remotely?
Yes, CVE-2011-2522 can be exploited remotely by an attacker who tricks an authenticated Samba SWAT user into visiting a malicious URL.
What protections are missing in CVE-2011-2522?
CVE-2011-2522 lacks protection against cross-site request forgery (CSRF) attacks in its user interface.