The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before
    1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share
    attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-
    integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an
    unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.
    (CVE-2013-0454)

This submission supersedes the Samba packages currently available from http://download.openSUSE.org/pub/opensuse/update/ for openSUSE versions 12.1 through 12.3.

  - Add support for PFC_FLAG_OBJECT_UUID when parsing     packets; (bso#9382).

  - Fix 'guest ok', 'force user' and 'force group' for guest     users; (bso#9746).

  - Fix 'map untrusted to domain' with NTLMv2; (bso#9817).

  - Fix crash bug in Winbind; (bso#9854).

  - Fix panic in nt_printer_publish_ads; (bso#9830).

According to its banner, the version of Samba 3.6.x running on the remote host is earlier than 3.6.6, and as such, it is potentially affected by a remote security bypass vulnerability because it fails to properly enforce CIFS share attributes. 

This may allow a remote, authenticated attacker to write to read-only shares, impact integrity related to oplock, locking, coherency, or leases or leases attributes. 

Note that Nessus has not actually tried to exploit this issue or otherwise determine if the patch or workaround has been applied.

It was discovered that Samba incorrectly handled CIFS share attributes when SMB2 was used. A remote authenticated user could possibly gain write access to certain shares, bypassing the intended permissions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Samba 3.6.x running on the remote host is earlier than 3.6.x. It is, therefore, affected by a remote security bypass vulnerability because it fails to properly enforce CIFS share attributes.

This may allow a remote, authenticated attacker to write to read-only shares, impact integrity related to oplock, locking, coherency, or leases or leases attributes

ID	Name	Product	Family	Type	Severity
465630	Echo: samba: security update to 2:3.6.6-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
465630	Echo: samba: security update to 2:3.6.6-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
75007	openSUSE Security Update : samba (openSUSE-SU-2013:0933-1)	Nessus	SuSE Local Security Checks	Local	medium
67118	Samba 3.6.x < 3.6.6 Remote Security Bypass	Nessus	Misc.	Remote	medium
65994	Ubuntu 12.04 LTS : samba vulnerability (USN-1802-1)	Nessus	Ubuntu Local Security Checks	Local	medium
6930	Samba 3.6.x < 3.6.6 Remote Security Bypass	Nessus Network Monitor	Samba		medium

Detections

Analytics

CVE-2013-0454

high

Tenable Plugins

high

high

medium

medium

medium

medium