CVE-2009-2948

Description

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

References

http://www.ubuntu.com/usn/USN-839-1

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.html

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439

http://secunia.com/advisories/36918

http://secunia.com/advisories/36953

http://www.vupen.com/english/advisories/2009/2810

http://secunia.com/advisories/36937

http://www.samba.org/samba/security/CVE-2009-2948.html

http://secunia.com/advisories/36893

http://osvdb.org/58520

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.html

http://www.securitytracker.com/id?1022975

http://www.securityfocus.com/bid/36572

http://news.samba.org/releases/3.3.8/

http://news.samba.org/releases/3.4.2/

http://news.samba.org/releases/3.2.15/

http://news.samba.org/releases/3.0.37/

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html

https://exchange.xforce.ibmcloud.com/vulnerabilities/53574

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434

Details

Risk Information

CVSS v2