CVE-2014-3560

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136280.html

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html

http://lists.opensuse.org/opensuse-updates/2014-08/msg00027.html

http://secunia.com/advisories/59583

http://secunia.com/advisories/59610

http://secunia.com/advisories/59976

http://www.samba.org/samba/security/CVE-2014-3560

http://www.securityfocus.com/bid/69021

http://www.securitytracker.com/id/1030663

http://www.ubuntu.com/usn/USN-2305-1

https://bugzilla.redhat.com/show_bug.cgi?id=1126010

https://exchange.xforce.ibmcloud.com/vulnerabilities/95081

https://git.samba.org/?p=samba.git;a=commitdiff;h=e6a848630da3ba958c442438ea131c99fa088605

https://git.samba.org/?p=samba.git;a=commitdiff;h=fb1d325d96dfe9bc2e9c4ec46ad4c55e8f18f4a2

Details

Source: MITRE

Published: 2014-08-06

Updated: 2019-04-22

Type: CWE-94

Risk Information

CVSS v2

Base Score: 7.9

Vector: AV:A/AC:M/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 5.5

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.10:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.16:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.17:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.18:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.19:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.20:*:*:*:*:*:*:*

Tenable Plugins

View all (15 total)

IDNameProductFamilySeverity
8759Samba 4.x < 4.0.21 / 4.1.x < 4.1.11 nmbd Remote Code ExecutionNessus Network MonitorSamba
high
77296openSUSE Security Update : samba (openSUSE-SU-2014:1040-1)NessusSuSE Local Security Checks
high
77268Fedora 19 : samba-4.0.21-1.fc19 (2014-9132)NessusFedora Local Security Checks
high
77073Fedora 20 : samba-4.1.9-4.fc20 (2014-9141)NessusFedora Local Security Checks
high
77058CentOS 7 : samba (CESA-2014:1008)NessusCentOS Local Security Checks
high
77017Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20140805)NessusScientific Linux Local Security Checks
high
77013RHEL 6 : samba4 (RHSA-2014:1009)NessusRed Hat Local Security Checks
high
77012RHEL 7 : samba (RHSA-2014:1008)NessusRed Hat Local Security Checks
high
77010Oracle Linux 6 : samba4 (ELSA-2014-1009)NessusOracle Linux Local Security Checks
high
77009Oracle Linux 7 : samba (ELSA-2014-1008)NessusOracle Linux Local Security Checks
high
77006CentOS 6 : samba4 (CESA-2014:1009)NessusCentOS Local Security Checks
high
76991Ubuntu 14.04 LTS : samba vulnerability (USN-2305-1)NessusUbuntu Local Security Checks
high
76985FreeBSD : samba -- remote code execution (89ff45e3-1a57-11e4-bebd-000c2980a9f3)NessusFreeBSD Local Security Checks
high
76974Slackware 14.1 / current : samba (SSA:2014-213-01)NessusSlackware Local Security Checks
high
76973Samba 4.x < 4.0.21 / 4.1.11 nmbd Remote Code ExecutionNessusMisc.
high