Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0178

Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.

Published

2014-05-28T04:58:32.690

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 3.5 (LOW)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

6.8

Impact Score

2.9

Weaknesses

Type: Primary
CWE-665

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	samba	samba	< 3.6.25	Yes
Application	samba	samba	< 4.0.18	Yes
Application	samba	samba	< 4.1.8	Yes
Application	samba	samba	4.1.0	Yes
Application	samba	samba	4.1.1	Yes
Application	samba	samba	4.1.2	Yes
Application	samba	samba	4.1.3	Yes
Application	samba	samba	4.1.4	Yes
Application	samba	samba	4.1.5	Yes
Application	samba	samba	4.1.6	Yes
Application	samba	samba	4.1.7	Yes
Application	samba	samba	3.6.6	Yes
Application	samba	samba	3.6.7	Yes
Application	samba	samba	3.6.8	Yes
Application	samba	samba	3.6.9	Yes
Application	samba	samba	3.6.10	Yes
Application	samba	samba	3.6.11	Yes
Application	samba	samba	3.6.12	Yes
Application	samba	samba	3.6.13	Yes
Application	samba	samba	3.6.14	Yes
Application	samba	samba	3.6.15	Yes
Application	samba	samba	3.6.16	Yes
Application	samba	samba	3.6.17	Yes
Application	samba	samba	3.6.18	Yes
Application	samba	samba	3.6.19	Yes
Application	samba	samba	3.6.20	Yes
Application	samba	samba	3.6.21	Yes
Application	samba	samba	3.6.22	Yes
Application	samba	samba	3.6.23	Yes

References

http://advisories.mageia.org/MGASA-2014-0279.html Third Party Advisory ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html Mailing List, Third Party Advisory ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html Mailing List, Third Party Advisory ([email protected])
http://secunia.com/advisories/59378 Third Party Advisory ([email protected])
http://secunia.com/advisories/59407 Third Party Advisory ([email protected])
http://secunia.com/advisories/59579 Third Party Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-201502-15.xml Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2014:136 Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2015:082 Broken Link ([email protected])
http://www.samba.org/samba/security/CVE-2014-0178 Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/532757/100/0/threaded Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/bid/67686 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1030308 Third Party Advisory, VDB Entry ([email protected])
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 Third Party Advisory ([email protected])
http://advisories.mageia.org/MGASA-2014-0279.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59378 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59407 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59579 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-201502-15.xml Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2014:136 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2015:082 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://www.samba.org/samba/security/CVE-2014-0178 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/532757/100/0/threaded Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/67686 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1030308 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)