Published: 25/06/2009 Updated: 17/08/2017

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 935

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 up to and including 3.2.12 might allow context-dependent malicious users to execute arbitrary code via format string specifiers in a filename.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba samba 3.2.5
samba samba 3.2.6
samba samba 3.2.12
samba samba 3.2.3
samba samba 3.2.2
samba samba 3.2.8
samba samba 3.2.9
samba samba 3.2.1
samba samba 3.2.0
samba samba 3.2.7
samba samba 3.2.4
samba samba 3.2.11
samba samba 3.2.10

J David Hester discovered that Samba incorrectly handled users that lack home directories when the automated [homes] share is enabled An authenticated user could connect to that share name and gain access to the whole filesystem (CVE-2009-2813) ...

source: wwwsecurityfocuscom/bid/35472/info Samba is prone to multiple vulnerabilities Attackers can leverage these issues to execute arbitrary code within the context of the vulnerable application or to bypass certain security restrictions Samba 3031 through 335 are affected The following proof of concept is available: smb: \&g ...

CWE-134 http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1886.patch http://www.vupen.com/english/advisories/2009/1664 http://www.securityfocus.com/bid/35472 https://bugzilla.samba.org/show_bug.cgi?id=6478 http://www.samba.org/samba/security/CVE-2009-1886.html http://secunia.com/advisories/35539 http://www.securitytracker.com/id?1022441 http://www.debian.org/security/2009/dsa-1823 http://secunia.com/advisories/35573 http://secunia.com/advisories/35606 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 http://www.mandriva.com/security/advisories?name=MDVSA-2009:196 http://www.ubuntu.com/usn/USN-839-1 http://secunia.com/advisories/36918 https://exchange.xforce.ibmcloud.com/vulnerabilities/51328 https://usn.ubuntu.com/839-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/33053/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-1886

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect