CVE-2015-7560: Medium severity samba vulnerability
Published Mar 13, 2016
·Updated
The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.
Affected Software
11 affected components
Samba Samba>=3.2.0<4.1.23
Samba Samba>=4.2.0<4.2.9
Samba Samba>=4.3.0<4.3.6
Samba Samba=4.4.0-rc1
Samba Samba=4.4.0-rc2
Samba Samba=4.4.0-rc3
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Event History
Mar 13, 2016
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7560?
CVE-2015-7560 is classified as a medium severity vulnerability.
2
How do I fix CVE-2015-7560?
To fix CVE-2015-7560, update Samba to versions 4.1.23, 4.2.9, 4.3.6, or 4.4.0rc4 or later.
3
Who is affected by CVE-2015-7560?
CVE-2015-7560 affects users of Samba versions 3.x and 4.x prior to the specified updates.
4
What type of vulnerability is CVE-2015-7560?
CVE-2015-7560 is a vulnerability that allows remote authenticated users to modify arbitrary ACLs.
5
When was CVE-2015-7560 discovered?
CVE-2015-7560 was published in 2015 and affects several releases of Samba.