Red Hat Security Advisory

RHSA-2011:1221

samba and cifs-utils security and bug fix update

Released 2011-08-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server (v. 6) cifs-utils-4.8.1-2.el6_1.2, libsmbclient-3.5.6-86.el6_1.4, libsmbclient-3.5.6-86.el6_1.4.ppc +7
Red Hat Enterprise Linux Server Optional (v. 6) libsmbclient-devel-3.5.6-86.el6_1.4, libsmbclient-devel-3.5.6-86.el6_1.4.ppc, samba-3.5.6-86.el6_1.4 +6

Fixes 5 records

TI-2011-02214 CVE-2011-2522 · GHSA-5cxg-6999-xfwq

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web…

MEDIUM 43

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.10621 Published 2011-07-29 Fixed CWE-352

TI-2011-03161 CVE-2011-3585 · GHSA-jf3j-jm33-ff6p

Race condition in Samba

LOW 22

Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file…

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00317 Published 2019-12-31 Fixed CWE-362

TI-2011-02355 CVE-2011-2694 · GHSA-9xqr-g3w9-82pj

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the…

LOW 22

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.06049 Published 2011-07-29 Fixed CWE-79

TI-2011-01463 CVE-2011-1678 · GHSA-v7g7-rpcw-4f58

smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the…

LOW 17

smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, whic…

CVSS 2.0LOW 3.3 Local No auth Interaction — EPSS 0.00531 Published 2011-04-10 Fixed CWE-20

TI-2011-02384 CVE-2011-2724 · GHSA-rv4g-gfv5-499c

The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and…

LOW 8

The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allow…

CVSS 2.0LOW 1.2 Local No auth Interaction — EPSS 0.00431 Published 2011-09-06 Partial fix CWE-20