CVEvulnerability
CVE-2015-7560
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-03-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-284
Description
The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.
Affected configurations
• samba samba (>= 3.2.0 < 4.1.23)
• samba samba (>= 4.2.0 < 4.2.9)
• samba samba (>= 4.3.0 < 4.3.6)
• samba samba 4.4.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 15.10
• debian debian linux 7.0
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html Mailing List, Third Party Advisory
- http://www.debian.org/security/2016/dsa-3514 Third Party Advisory
- http://www.securityfocus.com/bid/84267 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035220 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2922-1 Third Party Advisory
- https://bugzilla.samba.org/show_bug.cgi?id=11648 Issue Tracking, Vendor Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842 Third Party Advisory
- https://www.samba.org/samba/security/CVE-2015-7560.html Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html Mailing List, Third Party Advisory
- http://www.debian.org/security/2016/dsa-3514 Third Party Advisory
- http://www.securityfocus.com/bid/84267 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035220 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2922-1 Third Party Advisory
- https://bugzilla.samba.org/show_bug.cgi?id=11648 Issue Tracking, Vendor Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842 Third Party Advisory
- https://www.samba.org/samba/security/CVE-2015-7560.html Vendor Advisory