Published: 23/06/2001 Updated: 10/10/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba prior to 2.2.0a allows remote malicious users to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba samba 2.0.9
samba samba 2.2.0
samba samba 2.0.7
samba samba 2.0.8
samba samba 2.0.5
samba samba 2.0.6
hp cifs-9000 server a.01.05
hp cifs-9000 server a.01.06

Michal Zalewski discovered that Samba does not properly validate NetBIOS names from remote machines By itself that is not a problem, except if Samba is configured to write log-files to a file that includes the NetBIOS name of the remote side by using the `%m' macro in the `log file' command In that case an attacker could use a NetBIOS name like ' ...

source: wwwsecurityfocuscom/bid/2928/info Samba is a freely available file and printer sharing application maintained and developed by the Samba Development Team Samba allows file and printer sharing between operating systems on the Unix and Microsoft platforms A remote local user can write arbitrary files on the Samba server, as the s ...

NVD-CWE-Other http://www.securityfocus.com/archive/1/193027 http://www.securityfocus.com/bid/2928 http://us1.samba.org/samba/whatsnew/macroexploit.html http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-062.php3 http://www.securityfocus.com/advisories/3423 ftp://patches.sgi.com/support/free/security/advisories/20011002-01-P http://ciac.llnl.gov/ciac/bulletins/l-105.shtml http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-027-01 http://www.calderasystems.com/support/security/advisories/CSSA-2001-024.0.txt http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000405 http://www.redhat.com/support/errata/RHSA-2001-086.html http://www.debian.org/security/2001/dsa-065 https://exchange.xforce.ibmcloud.com/vulnerabilities/6731 https://nvd.nist.gov https://www.debian.org/security/./dsa-065 https://www.exploit-db.com/exploits/20968/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2001-1162

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect