Headline

CVE-2013-4475: Samba - Release Notes Archive

Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).

11 years ago

CVE

Open in Source

#ldap #samba #ssl

Samba 4.0.11 Available for Download

               ==============================
               Release Notes for Samba 4.0.11
                      November 11, 2013
               ==============================

This is a security release in order to address CVE-2013-4475 (ACLs are not checked on opening an alternate data stream on a file or directory) and CVE-2013-4476 (Private key in key.pem world readable).

o CVE-2013-4475: Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying file or directory ACL when opening an alternate data stream.

According to the SMB1 and SMB2+ protocols the ACL on an underlying file or directory should control what access is allowed to alternate data streams that are associated with the file or directory.

By default no version of Samba supports alternate data streams on files or directories.

Samba can be configured to support alternate data streams by loading either one of two virtual file system modues (VFS) vfs_streams_depot or vfs_streams_xattr supplied with Samba, so this bug only affects Samba servers configured this way.

To determine if your server is vulnerable, check for the strings “streams_depot” or “streams_xattr” inside your smb.conf configuration file.

o CVE-2013-4476: In setups which provide ldap(s) and/or https services, the private key for SSL/TLS encryption might be world readable. This typically happens in active directory domain controller setups.