VulnerabilityModified

CVE-2015-7560

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then…

MEDIUM 6.5EPSS 12.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 12.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 12.94% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: samba/samba · canonical/ubuntu linux · debian/debian linux
Source: secalert@redhat.com

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlMailing List, Third Party Advisory
http://www.debian.org/security/2016/dsa-3514Third Party Advisory
http://www.securityfocus.com/bid/84267Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035220Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2922-1Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=11648Issue Tracking, Vendor Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842Third Party Advisory
https://www.samba.org/samba/security/CVE-2015-7560.htmlVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlMailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.