cve-2013-0454
Vulnerability from cvelistv5
Published
2013-03-26 21:00
Modified
2024-08-06 14:25
Severity ?
EPSS score ?
Summary
The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:25:10.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "storwize-cifs-incorrect-permissions(80970)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"
},
{
"name": "USN-1802-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1802-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.samba.org/samba/security/CVE-2013-0454"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"
},
{
"name": "[samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or \"hide unreadable\" parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "storwize-cifs-incorrect-permissions(80970)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"
},
{
"name": "USN-1802-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1802-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.samba.org/samba/security/CVE-2013-0454"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"
},
{
"name": "[samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"ID": "CVE-2013-0454",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or \"hide unreadable\" parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "storwize-cifs-incorrect-permissions(80970)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=928419",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"
},
{
"name": "USN-1802-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1802-1"
},
{
"name": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289",
"refsource": "CONFIRM",
"url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"
},
{
"name": "https://www.samba.org/samba/security/CVE-2013-0454",
"refsource": "CONFIRM",
"url": "https://www.samba.org/samba/security/CVE-2013-0454"
},
{
"name": "https://bugzilla.samba.org/show_bug.cgi?id=8738",
"refsource": "MISC",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"
},
{
"name": "[samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download",
"refsource": "MLIST",
"url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2013-0454",
"datePublished": "2013-03-26T21:00:00",
"dateReserved": "2012-12-16T00:00:00",
"dateUpdated": "2024-08-06T14:25:10.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2013-0454\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2013-03-26T21:55:01.100\",\"lastModified\":\"2017-08-29T01:33:01.747\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or \\\"hide unreadable\\\" parameter.\"},{\"lang\":\"es\",\"value\":\"Samba anterior a v3.6.6, tal como se utiliza en el IBM Storwize V7000 Unified v1.3 anterior a v1.3.2.3, y v1.4 anterior a v1.4.0.1 y posiblemente otros productos, no se aplican correctamente los atributos de CIFS de compartici\u00f3n, lo que permite a usuarios remotos autenticados para (1) escribir en un participaci\u00f3n de s\u00f3lo lectura, (2) disparar problemas de integridad de datos relacionados con la operaci\u00f3n de bloqueo, bloqueo, coherencia, arrendamiento de atributo, o (3) tener un impacto no especificado mediante el aprovechamiento de la manipulaci\u00f3n incorrecta del par\u00e1metro \\\"hide unreadable\\\".\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*\",\"matchCriteriaId\":\"F5D324C4-97C7-49D3-A809-9EAD4B690C69\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.6.5\",\"matchCriteriaId\":\"C8B4B6AD-425B-43F5-BBDC-3109CBD33F6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:samba:samba:3.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66999F57-FF99-419F-BB12-35DC79FCE945\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:samba:samba:3.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BD1356E-3B43-4C5B-9969-902440918EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:samba:samba:3.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A7F3209-B376-490B-A761-2CCB6CEE209A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:samba:samba:3.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"406C2297-B58D-4623-9E7A-2C438ABBAC93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:samba:samba:3.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6AF0DD4-08D4-4726-8A12-E979FF3322B0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:storwize:v7000:1.3:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDD7FC50-A974-4C73-8217-F4E838C30286\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:storwize:v7000:1.4:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CB5E582-68FB-4513-9C2E-474E2B7B47CB\"}]}]}],\"references\":[{\"url\":\"http://www.ibm.com/support/docview.wss?uid=ssg1S1004289\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-1802-1\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=928419\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"https://bugzilla.samba.org/show_bug.cgi?id=8738\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/80970\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"https://lists.samba.org/archive/samba-announce/2012/000259.html\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"https://www.samba.org/samba/security/CVE-2013-0454\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.