CVE-2009-2948
LOW severity · CVSS 1.9 · Incorrect permission assignment
1.9CVSS LOW
Summary
mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.
Impact & exploitability
Attack vectorLocal
Attack complexity—
Privileges required—
User interaction—
Confidentiality impact—
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)1%
AV:L/AC:M/Au:N/C:P/I:N/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://news.samba.org/releases/3.0.37/Advisory
- http://news.samba.org/releases/3.2.15/Advisory
- http://news.samba.org/releases/3.3.8/Advisory
- http://news.samba.org/releases/3.4.2/Advisory
- http://secunia.com/advisories/36893Advisory
- http://secunia.com/advisories/36918Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlAdvisory
- http://osvdb.org/58520