Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-1888

The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.

Published

2009-06-25T01:30:01.750

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

4.9

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	samba	samba	≤ 3.0.35	Yes
Application	samba	samba	< 3.2.13	Yes
Application	samba	samba	< 3.3.6	Yes
Operating System	debian	debian_linux	4.0	Yes
Operating System	debian	debian_linux	5.0	Yes
Operating System	canonical	ubuntu_linux	6.06	Yes
Operating System	canonical	ubuntu_linux	8.04	Yes
Operating System	canonical	ubuntu_linux	8.10	Yes
Operating System	canonical	ubuntu_linux	9.04	Yes

References

http://secunia.com/advisories/35539 Third Party Advisory ([email protected])
http://secunia.com/advisories/35573 Third Party Advisory ([email protected])
http://secunia.com/advisories/35606 Third Party Advisory ([email protected])
http://secunia.com/advisories/36918 Third Party Advisory ([email protected])
http://wiki.rpath.com/Advisories:rPSA-2009-0145 Third Party Advisory ([email protected])
http://www.debian.org/security/2009/dsa-1823 Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2009:196 Third Party Advisory ([email protected])
http://www.samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch Exploit, Patch, Vendor Advisory ([email protected])
http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch Patch, Vendor Advisory ([email protected])
http://www.samba.org/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch Patch, Vendor Advisory ([email protected])
http://www.samba.org/samba/security/CVE-2009-1888.html Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/507856/100/0/threaded Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/bid/35472 Exploit, Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id?1022442 Third Party Advisory, VDB Entry ([email protected])
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 Third Party Advisory ([email protected])
http://www.ubuntu.com/usn/USN-839-1 Third Party Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/1664 Permissions Required, Third Party Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/51327 Third Party Advisory, VDB Entry ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10790 Third Party Advisory ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7292 Third Party Advisory ([email protected])
http://secunia.com/advisories/35539 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35573 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35606 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/36918 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://wiki.rpath.com/Advisories:rPSA-2009-0145 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2009/dsa-1823 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:196 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch Exploit, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.samba.org/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.samba.org/samba/security/CVE-2009-1888.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/507856/100/0/threaded Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/35472 Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1022442 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-839-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1664 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/51327 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10790 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7292 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)