5
CVSSv2

CVE-2015-5252

Published: 29/12/2015 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.2 | Impact Score: 2.7 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Summary

vfs.c in smbd in Samba 3.x and 4.x prior to 4.1.22, 4.2.x prior to 4.2.7, and 4.3.x prior to 4.3.3, when share names with certain substring relationships exist, allows remote malicious users to bypass intended file-access restrictions via a symlink that points outside of a share.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

samba samba

canonical ubuntu linux 15.10

canonical ubuntu linux 15.04

canonical ubuntu linux 14.04

canonical ubuntu linux 12.04

debian debian linux 8.0

debian debian linux 7.0

Vendor Advisories

Several security issues were fixed in Samba ...
USN-2855-1 introduced a regression in Samba ...
Synopsis Moderate: samba security update Type/Severity Security Advisory: Moderate Topic Updated samba packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scoring Sys ...
Synopsis Moderate: samba4 security update Type/Severity Security Advisory: Moderate Topic Updated samba4 packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scoring S ...
Synopsis Moderate: samba security update Type/Severity Security Advisory: Moderate Topic Updated samba packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scoring Sys ...
Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2015-7560 Jeremy Allison of Google, Inc and the Samba Team discovered that Samba incorrectly handles getting and setting ACLs on a symlink path ...
Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2015-3223 Thilo Uttendorfer of Linux Information Systems AG discovered that a malicious request can cause the Samba LDAP server to hang, spinning ...
A missing access control flaw was found in Samba A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORY_LIST access rights An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share A remote attacker could exploit this flaw t ...
An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share A remote attacker could exploit this flaw to gain access to files outside of Samba's share path ...

References

CWE-264https://bugzilla.redhat.com/show_bug.cgi?id=1290288https://www.samba.org/samba/security/CVE-2015-5252.htmlhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlhttp://www.securityfocus.com/bid/79733http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00046.htmlhttp://www.ubuntu.com/usn/USN-2855-2http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.htmlhttp://www.ubuntu.com/usn/USN-2855-1http://www.securitytracker.com/id/1034493http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.htmlhttp://www.debian.org/security/2016/dsa-3433http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00002.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.htmlhttps://security.gentoo.org/glsa/201612-47https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=4278ef25f64d5fdbf432ff1534e275416ec9561ehttps://nvd.nist.govhttps://usn.ubuntu.com/2855-1/