CVEvulnerability
CVE-2009-1888
5.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-06-25
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-264
Description
The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.
Affected configurations
• samba samba (>= 3.0.31 <= 3.0.35)
• samba samba (>= 3.2.0 < 3.2.13)
• samba samba (>= 3.3.0 < 3.3.6)
• debian debian linux 4.0
• debian debian linux 5.0
• canonical ubuntu linux 6.06
• canonical ubuntu linux 8.04
• canonical ubuntu linux 8.10
• canonical ubuntu linux 9.04
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/35539 Third Party Advisory
- http://secunia.com/advisories/35573 Third Party Advisory
- http://secunia.com/advisories/35606 Third Party Advisory
- http://secunia.com/advisories/36918 Third Party Advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0145 Third Party Advisory
- http://www.debian.org/security/2009/dsa-1823 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:196 Third Party Advisory
- http://www.samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch Exploit, Patch, Vendor Advisory
- http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch Patch, Vendor Advisory
- http://www.samba.org/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch Patch, Vendor Advisory
- http://www.samba.org/samba/security/CVE-2009-1888.html Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/507856/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/35472 Exploit, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1022442 Third Party Advisory, VDB Entry
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 Third Party Advisory
- http://www.ubuntu.com/usn/USN-839-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2009/1664 Permissions Required, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51327 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10790 Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7292 Third Party Advisory
- http://secunia.com/advisories/35539 Third Party Advisory
- http://secunia.com/advisories/35573 Third Party Advisory
- http://secunia.com/advisories/35606 Third Party Advisory
- http://secunia.com/advisories/36918 Third Party Advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0145 Third Party Advisory
- http://www.debian.org/security/2009/dsa-1823 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:196 Third Party Advisory
- http://www.samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch Exploit, Patch, Vendor Advisory
- http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch Patch, Vendor Advisory
- http://www.samba.org/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch Patch, Vendor Advisory
- http://www.samba.org/samba/security/CVE-2009-1888.html Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/507856/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/35472 Exploit, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1022442 Third Party Advisory, VDB Entry
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 Third Party Advisory
- http://www.ubuntu.com/usn/USN-839-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2009/1664 Permissions Required, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51327 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10790 Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7292 Third Party Advisory