SA
Product
samba
On CISA KEVExploited in the wildRansomware-linked
217
CVEs
2
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 42Medium 76Low 1
Watch
Add samba to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-2411 | – | Oct 2 | Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute… Affected: All versions, or not specified |
| CVE-2011-2724 | – | Sep 6 | The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are… Affected: through 3.5.10; 1.9.17; 1.9.17; 1.9.17; 1.9.17; 1.9.17; +34 more |
| CVE-2011-2694 | – | Jul 29 | Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote… Affected: 3.0.0 before 3.3.16; 3.4.0 before 3.4.14; 3.5.0 before 3.5.10 |
| CVE-2011-2522 | – | Jul 29 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the… Affected: 3.0.0 before 3.3.16; 3.4.0 before 3.4.14; 3.5.0 before 3.5.10 |
| CVE-2011-1678 | – | Apr 10 | smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking… Affected: through 3.5.8 |
| CVE-2011-0719 | – | Mar 1 | Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2; 3.0.2a; 3.0.3; +34 more |
| CVE-2010-3069 | – | Sep 15 | Stack-based buffer overflow in the (1) sid_parse and (2) dom_sid_parse functions in Samba before 3.5.5 allows remote attackers to cause a denial of service (crash) and possibly… Affected: 3.0.0 through 3.3.14; 3.4.0 before 3.4.9; 3.5.0 before 3.5.5 |
| CVE-2010-2063 | – | Jun 17 | Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial… Affected: 3.0.0 through 3.3.12 |
| CVE-2010-1642 | – | Jun 17 | The reply_sesssetup_and_X_spnego function in sesssetup.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to trigger an out-of-bounds read, and cause a… Affected: through 3.4.7; 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; +34 more |
| CVE-2010-1635 | – | Jun 17 | The chain_reply function in process.c in smbd in Samba before 3.4.8 and 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: through 3.4.7; 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; +34 more |
| CVE-2010-0926 | – | Mar 10 | The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to… Affected: 3.3.0; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +12 more |
| CVE-2010-0728 | – | Mar 10 | smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE capability, which allows remote authenticated users to bypass intended file… Affected: 3.3.11; 3.4.6; 3.5.0 |
| CVE-2010-0787 | – | Mar 2 | client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain… Affected: 3.0.22; 3.0.28a; 3.2.3; 3.4.0; 3.4.5 |
| CVE-2010-0547 | – | Feb 4 | client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which… Affected: through 3.4.5; 1.9.17; 1.9.17; 1.9.17; 1.9.17; 1.9.17; +34 more |
| CVE-2009-2948 | – | Oct 7 | mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions,… Affected: 3.0.0 before 3.0.37; 3.2.0 before 3.2.15; 3.3.0 before 3.3.8; 3.4.0 before 3.4.2 |
| CVE-2009-2906 | – | Oct 7 | smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an… Affected: before 3.0.37; 3.2.0 before 3.2.15; 3.3.0 before 3.3.8; 3.4.0; 3.4.1 |
| CVE-2009-2813 | – | Sep 14 | Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled,… Affected: 3.0.12; 3.0.13; 3.0.14; 3.0.14a; 3.0.15; 3.0.16; +34 more |
| CVE-2009-1888 | – | Jun 25 | The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled,… Affected: 3.0.31 through 3.0.35; 3.2.0 before 3.2.13; 3.3.0 before 3.3.6 |
| CVE-2009-1886 | – | Jun 25 | Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +7 more |
| CVE-2009-0022 | – | Jan 5 | Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +1 more |
| CVE-2008-4314 | – | Dec 1 | smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests,… Affected: 3.0.29; 3.0.30; 3.0.31; 3.0.32; 3.0.33; 3.2.0; +4 more |
| CVE-2008-3789 | – | Aug 27 | Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups Affected: 3.2.0 before 3.2.3 |
| CVE-2008-1105 | – | May 29 | Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB… Affected: 3.0.0 through 3.0.29 |
| CVE-2007-6015 | – | Dec 13 | Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute… Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +34 more |
| CVE-2007-5398 | – | Nov 16 | Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; 3.0.4; +34 more |
| CVE-2007-4572 | – | Nov 16 | Stack-based buffer overflow in nmbd in Samba 3.0.0 through 3.0.26a, when configured as a Primary or Backup Domain controller, allows remote attackers to have an unknown impact via… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; 3.0.4; +34 more |
| CVE-2007-4138 | – | Sep 14 | The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local… Affected: 3.0.25; 3.0.25a; 3.0.25b; 3.0.25c |
| CVE-2007-2444 | – | May 14 | Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privileges and execute SMB/CIFS protocol… Affected: 3.0.23d; 3.0.24; 3.0.25 |
| CVE-2007-2446 | – | May 14 | Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.10; 3.0.11; +28 more |
| CVE-2007-2447 | – | May 14 | The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1)… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; 3.0.4; +34 more |
| CVE-2007-0453 | – | Feb 6 | Buffer overflow in the nss_winbind.so.1 library in Samba 3.0.21 through 3.0.23d, as used in the winbindd daemon on Solaris, allows attackers to execute arbitrary code via the (1)… Affected: 3.0.21; 3.0.21a; 3.0.21b; 3.0.21c; 3.0.22; 3.0.23; +4 more |
| CVE-2007-0452 | – | Feb 6 | smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request… Affected: 3.0.6; 3.0.7; 3.0.8; 3.0.9; 3.0.10; 3.0.11; +16 more |
| CVE-2007-0454 | – | Feb 6 | Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in… Affected: 3.0.6; 3.0.7; 3.0.8; 3.0.9; 3.0.10; 3.0.11; +13 more |
| CVE-2006-3403 | – | Jul 12 | The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection… Affected: 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; 3.0.6; +21 more |
| CVE-2006-1059 | – | Mar 30 | The winbindd daemon in Samba 3.0.21 to 3.0.21c writes the machine trust account password in cleartext in log files, which allows local users to obtain the password and spoof the… Affected: 3.0.21; 3.0.21a; 3.0.21b; 3.0.21c |
| CVE-2004-0882 | – | Jan 27 | Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a TRANSACT2_QFILEPATHINFO request with a… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; 3.0.4; +4 more |
| CVE-2004-0930 | – | Jan 27 | The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request… Affected: 3.0.0; 3.0.3; 3.0.4; 3.0.5; 3.0.6; 3.0.7 |
| CVE-2004-1154 | – | Jan 10 | Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2004-0808 | – | Dec 31 | The process_logon_packet function in the nmbd server for Samba 3.0.6 and earlier, when domain logons are enabled, allows remote attackers to cause a denial of service via a… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; 3.0.4; +3 more |
| CVE-2004-0829 | – | Dec 31 | smbd in Samba before 2.2.11 allows remote attackers to cause a denial of service (daemon crash) by sending a FindNextPrintChangeNotify request without a previous… Affected: 1.9.17; 1.9.17; 1.9.17; 1.9.17; 1.9.17; 1.9.17; +33 more |
| CVE-2004-2546 | – | Dec 31 | Multiple memory leaks in Samba before 3.0.6 allow attackers to cause a denial of service (memory consumption) Affected: 1.9.17; 1.9.17; 1.9.17; 1.9.17; 1.9.17; 1.9.18; +29 more |
| CVE-2004-2687 | – | Dec 31 | distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs,… Affected: through 2.18.3 |
| CVE-2004-0815 | – | Nov 3 | The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to… Affected: 2.2.0; 2.2.0a; 2.2.1a; 2.2.2; 2.2.3; 2.2.3a; +14 more |
| CVE-2004-0807 | – | Sep 13 | Samba 3.0.6 and earlier allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via certain malformed requests that cause new processes to be… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.2a; 3.0.3; 3.0.4; +3 more |
| CVE-2004-0686 | – | Jul 27 | Buffer overflow in Samba 2.2.x to 2.2.9, and 3.0.0 to 3.0.4, when the "mangling method = hash" option is enabled in smb.conf, has unknown impact and attack vectors Affected: 2.2.0 before 2.2.10; 3.0.0 before 3.0.5 |
| CVE-2004-0600 | – | Jul 27 | Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP… Affected: 3.0.2; 3.0.2a; 3.0.3; 3.0.4 |
| CVE-2004-0186 | – | Mar 15 | smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose… Affected: 2.0; 3.0.0 |
| CVE-2004-0082 | – | Mar 3 | The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized… Affected: 3.0.0; 3.0.1 |
| CVE-2003-1332 | – | Dec 31 | Stack-based buffer overflow in the reply_nttrans function in Samba 2.2.7a and earlier allows remote attackers to execute arbitrary code via a crafted request, a different… Affected: through 2.2.7a |
| CVE-2003-0201 | – | May 5 | Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +15 more |