CVE-2011-0719

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd.

References

http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056229.html

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056241.html

http://marc.info/?l=bugtraq&m=130835366526620&w=2

http://samba.org/samba/security/CVE-2011-0719.html

http://secunia.com/advisories/43482

http://secunia.com/advisories/43503

http://secunia.com/advisories/43512

http://secunia.com/advisories/43517

http://secunia.com/advisories/43556

http://secunia.com/advisories/43557

http://secunia.com/advisories/43843

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593629

http://support.apple.com/kb/HT4723

http://www.debian.org/security/2011/dsa-2175

http://www.mandriva.com/security/advisories?name=MDVSA-2011:038

http://www.redhat.com/support/errata/RHSA-2011-0305.html

http://www.redhat.com/support/errata/RHSA-2011-0306.html

http://www.samba.org/samba/history/samba-3.3.15.html

http://www.samba.org/samba/history/samba-3.4.12.html

http://www.samba.org/samba/history/samba-3.5.7.html

http://www.securityfocus.com/bid/46597

http://www.securitytracker.com/id?1025132

http://www.ubuntu.com/usn/USN-1075-1

http://www.vupen.com/english/advisories/2011/0517

http://www.vupen.com/english/advisories/2011/0518

http://www.vupen.com/english/advisories/2011/0519

http://www.vupen.com/english/advisories/2011/0520

http://www.vupen.com/english/advisories/2011/0522

http://www.vupen.com/english/advisories/2011/0541

http://www.vupen.com/english/advisories/2011/0702

https://bugzilla.redhat.com/show_bug.cgi?id=678328

https://exchange.xforce.ibmcloud.com/vulnerabilities/65724

Details

Source: MITRE

Published: 2011-03-01

Updated: 2018-10-30

Type: CWE-119

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:samba:samba:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.2:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.4:rc1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.14:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.14a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.16:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.17:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.18:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.19:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.20:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.20:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.20:b:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.20a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.20b:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.21:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.21:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.21:b:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.21:c:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.21a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.21b:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.21c:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.22:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23:b:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23:c:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23:d:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23b:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23c:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.23d:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.24:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:b:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:c:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:pre1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:pre2:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:rc1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:rc2:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:rc3:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25b:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25c:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.26:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.26:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.26a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.27:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.27:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.28:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.28:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.29:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.30:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.31:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.32:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.33:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.34:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.35:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.36:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.37:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.14:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:samba:samba:3.4.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.4.11:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:samba:samba:3.5.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.5.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.5.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.5.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.5.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.5.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.5.6:*:*:*:*:*:*:*

Tenable Plugins

View all (27 total)

IDNameProductFamilySeverity
75447openSUSE Security Update : cifs-mount (openSUSE-SU-2011:0403-1)NessusSuSE Local Security Checks
medium
68209Oracle Linux 5 : samba3x (ELSA-2011-0306)NessusOracle Linux Local Security Checks
medium
68208Oracle Linux 4 / 5 / 6 : samba (ELSA-2011-0305)NessusOracle Linux Local Security Checks
medium
60973Scientific Linux Security Update : samba on SL6.x i386/x86_64NessusScientific Linux Local Security Checks
medium
60972Scientific Linux Security Update : samba on SL4.x, SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
60971Scientific Linux Security Update : samba3x on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
59675GLSA-201206-22 : Samba: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
57165SuSE 10 Security Update : Samba (ZYPP Patch Number 7396)NessusSuSE Local Security Checks
medium
55416Mac OS X 10.6.x < 10.6.8 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
55415Mac OS X Multiple Vulnerabilities (Security Update 2011-004)NessusMacOS X Local Security Checks
high
800790Mac OS X 10.6 < 10.6.8 Multiple VulnerabilitiesLog Correlation EngineOperating System Detection
high
5968Mac OS X 10.6 < 10.6.8 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
55396FreeBSD : Samba -- Denial of service - memory corruption (bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41)NessusFreeBSD Local Security Checks
medium
53700openSUSE Security Update : cifs-mount (openSUSE-SU-2011:0403-1)NessusSuSE Local Security Checks
medium
53589SuSE 10 Security Update : Samba (ZYPP Patch Number 7353)NessusSuSE Local Security Checks
medium
53586SuSE 11.1 Security Update : Samba (SAT Patch Number 4050)NessusSuSE Local Security Checks
medium
53423CentOS 5 : samba3x (CESA-2011:0306)NessusCentOS Local Security Checks
medium
52723Fedora 13 : samba-3.5.8-74.fc13 (2011-3120)NessusFedora Local Security Checks
medium
52722Fedora 14 : samba-3.5.8-74.fc14 (2011-3118)NessusFedora Local Security Checks
medium
52505CentOS 4 / 5 : samba (CESA-2011:0305)NessusCentOS Local Security Checks
medium
52503Samba 3.x < 3.3.15 / 3.4.12 / 3.5.7 'FD_SET' Memory CorruptionNessusMisc.
medium
52490RHEL 5 : samba3x (RHSA-2011:0306)NessusRed Hat Local Security Checks
medium
52489RHEL 4 / 5 / 6 : samba (RHSA-2011:0305)NessusRed Hat Local Security Checks
medium
52477Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : samba vulnerability (USN-1075-1)NessusUbuntu Local Security Checks
medium
52469Mandriva Linux Security Advisory : samba (MDVSA-2011:038)NessusMandriva Local Security Checks
medium
52463Debian DSA-2175-1 : samba - missing input sanitisingNessusDebian Local Security Checks
medium
52460Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 8.1 / 9.0 / 9.1 / current : samba (SSA:2011-059-01)NessusSlackware Local Security Checks
medium