Red Hat Security Advisory

RHSA-2011:1220

samba3x security update

Released 2011-08-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHEL Desktop Workstation (v. 5 client) samba3x-3.5.4-0.83.el5_7.2, samba3x-winbind-devel-3.5.4-0.83.el5_7.2, samba3x-winbind-devel-3.5.4-0.83.el5_7.2.i386
Red Hat Enterprise Linux (v. 5 server) samba3x-3.5.4-0.83.el5_7.2, samba3x-3.5.4-0.83.el5_7.2.i386, samba3x-3.5.4-0.83.el5_7.2.ia64 +29
Red Hat Enterprise Linux Desktop (v. 5 client) samba3x-3.5.4-0.83.el5_7.2, samba3x-3.5.4-0.83.el5_7.2.i386, samba3x-client-3.5.4-0.83.el5_7.2 +11

Fixes 4 records

TI-2011-02214 CVE-2011-2522 · GHSA-5cxg-6999-xfwq

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web…

MEDIUM 43

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.10621 Published 2011-07-29 Fixed CWE-352

TI-2011-02355 CVE-2011-2694 · GHSA-9xqr-g3w9-82pj

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the…

LOW 22

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.06049 Published 2011-07-29 Fixed CWE-79

TI-2011-01463 CVE-2011-1678 · GHSA-v7g7-rpcw-4f58

smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the…

LOW 17

smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, whic…

CVSS 2.0LOW 3.3 Local No auth Interaction — EPSS 0.00531 Published 2011-04-10 Fixed CWE-20

TI-2011-02384 CVE-2011-2724 · GHSA-rv4g-gfv5-499c

The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and…

LOW 8

The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allow…

CVSS 2.0LOW 1.2 Local No auth Interaction — EPSS 0.00431 Published 2011-09-06 Partial fix CWE-20