CVE-2013-4476: Low severity samba vulnerability
Published Nov 13, 2013
·Updated
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Affected Software
12 affected components
Samba Samba=4.0.0
Samba Samba=4.0.1
Samba Samba=4.0.2
Samba Samba=4.0.3
Samba Samba=4.0.4
Samba Samba=4.0.5
Samba Samba=4.0.6
Samba Samba=4.0.7
Samba Samba=4.0.8
Samba Samba=4.0.9
Samba Samba=4.0.10
Samba Samba=4.1.0
Event History
Nov 13, 2013
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4476?
CVE-2013-4476 has a medium severity due to its potential impact on confidentiality.
2
How do I fix CVE-2013-4476?
To fix CVE-2013-4476, upgrade Samba to version 4.0.11 or 4.1.1 or later.
3
What versions of Samba are affected by CVE-2013-4476?
Samba versions 4.0.0 to 4.0.10 and 4.1.0 are affected by CVE-2013-4476.
4
What are the risks associated with CVE-2013-4476?
The risks of CVE-2013-4476 include local users being able to read sensitive private key files.
5
Is CVE-2013-4476 related to SSL configurations in Samba?
Yes, CVE-2013-4476 specifically affects Samba when SSL is used for LDAP or HTTP connections.