CVE-2009-2948
mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the…
Does this matter?
Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.
Description
mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.
- CVSS 2.0
- 1.9 LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 0.52% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- samba/samba
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlMailing List, Third Party Advisory
- http://news.samba.org/releases/3.0.37/Broken Link, Vendor Advisory
- http://news.samba.org/releases/3.2.15/Broken Link, Vendor Advisory
- http://news.samba.org/releases/3.3.8/Broken Link, Vendor Advisory
- http://news.samba.org/releases/3.4.2/Broken Link, Vendor Advisory
- http://osvdb.org/58520Broken Link
- http://secunia.com/advisories/36893Not Applicable, Vendor Advisory
- http://secunia.com/advisories/36918Not Applicable, Vendor Advisory
- http://secunia.com/advisories/36937Not Applicable, Vendor Advisory
- http://secunia.com/advisories/36953Not Applicable, Vendor Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439Patch, Third Party Advisory
- http://www.samba.org/samba/security/CVE-2009-2948.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/36572Patch, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1022975Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-839-1Third Party Advisory
- http://www.vupen.com/english/advisories/2009/2810Permissions Required, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53574Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434Broken Link, Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087Broken Link, Third Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.htmlPatch, Third Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.htmlPatch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlMailing List, Third Party Advisory
- http://news.samba.org/releases/3.0.37/Broken Link, Vendor Advisory
- http://news.samba.org/releases/3.2.15/Broken Link, Vendor Advisory
- http://news.samba.org/releases/3.3.8/Broken Link, Vendor Advisory
- http://news.samba.org/releases/3.4.2/Broken Link, Vendor Advisory
- http://osvdb.org/58520Broken Link
- http://secunia.com/advisories/36893Not Applicable, Vendor Advisory
- http://secunia.com/advisories/36918Not Applicable, Vendor Advisory
- http://secunia.com/advisories/36937Not Applicable, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.