Detections
Analytics
Samba 3.x < 3.4.17 / 3.5.x < 3.5.15 / 3.6.x < 3.6.5 Remote Security Bypass
medium Nessus Network Monitor Plugin ID 9344
Synopsis
The remote Samba server is affected by a remote security bypass attack vector.Description
According to its banner, the version of Samba is 3.4.x earlier than 3.4.17, 3.5.x earlier than 3.5.15, or 3.6.x earlier than 3.6.5. It is therefore affected by a flaw in the application security checks for the 'CreateAccount', 'OpenAccount', 'AddAccountRights', and 'RemoveAccountRights' remote procedure calls in the local security authority. This may allow a remote attacker to manipulate the ownership of arbitrary files and directories.Solution
Upgrade Samba to version 3.6.5 or later. If version 3.6.x cannot be obtained, versions 3.5.15 and 3.4.17 have also been patched for this issue.See Also
http://www.samba.org/samba/security/CVE-2012-2111
http://www.samba.org/samba/history/samba-3.4.17.html
Plugin Details
Severity: Medium
ID: 9344
Family: Samba
Published: 6/9/2016
Updated: 3/6/2019
Nessus ID: 58949
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 6
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:samba:samba
Patch Publication Date: 4/30/2012
Vulnerability Publication Date: 4/30/2012
Reference Information
CVE: CVE-2012-2111
BID: 53307