{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-03-22T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or \"hide unreadable\" parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01.000Z", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "storwize-cifs-incorrect-permissions(80970)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"}, {"name": "USN-1802-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1802-1"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.samba.org/samba/security/CVE-2013-0454"}, {"tags": ["x_refsource_MISC"], "url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"}, {"name": "[samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2013-0454", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or \"hide unreadable\" parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "storwize-cifs-incorrect-permissions(80970)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=928419", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"}, {"name": "USN-1802-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1802-1"}, {"name": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289", "refsource": "CONFIRM", "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"}, {"name": "https://www.samba.org/samba/security/CVE-2013-0454", "refsource": "CONFIRM", "url": "https://www.samba.org/samba/security/CVE-2013-0454"}, {"name": "https://bugzilla.samba.org/show_bug.cgi?id=8738", "refsource": "MISC", "url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"}, {"name": "[samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download", "refsource": "MLIST", "url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T14:25:10.343Z"}, "title": "CVE Program Container", "references": [{"name": "storwize-cifs-incorrect-permissions(80970)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"}, {"name": "USN-1802-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-1802-1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.samba.org/samba/security/CVE-2013-0454"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"}, {"name": "[samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2013-0454", "datePublished": "2013-03-26T21:00:00.000Z", "dateReserved": "2012-12-16T00:00:00.000Z", "dateUpdated": "2024-08-06T14:25:10.343Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*", "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8B4B6AD-425B-43F5-BBDC-3109CBD33F6D", "versionEndIncluding": "3.6.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:3.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "66999F57-FF99-419F-BB12-35DC79FCE945", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:3.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "5BD1356E-3B43-4C5B-9969-902440918EE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:3.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "7A7F3209-B376-490B-A761-2CCB6CEE209A", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:3.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "406C2297-B58D-4623-9E7A-2C438ABBAC93", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:3.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "B6AF0DD4-08D4-4726-8A12-E979FF3322B0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:storwize:v7000:1.3:*:*:*:*:*:*", "matchCriteriaId": "BDD7FC50-A974-4C73-8217-F4E838C30286", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storwize:v7000:1.4:*:*:*:*:*:*", "matchCriteriaId": "9CB5E582-68FB-4513-9C2E-474E2B7B47CB", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or \"hide unreadable\" parameter."}, {"lang": "es", "value": "Samba anterior a v3.6.6, tal como se utiliza en el IBM Storwize V7000 Unified v1.3 anterior a v1.3.2.3, y v1.4 anterior a v1.4.0.1 y posiblemente otros productos, no se aplican correctamente los atributos de CIFS de compartici\u00f3n, lo que permite a usuarios remotos autenticados para (1) escribir en un participaci\u00f3n de s\u00f3lo lectura, (2) disparar problemas de integridad de datos relacionados con la operaci\u00f3n de bloqueo, bloqueo, coherencia, arrendamiento de atributo, o (3) tener un impacto no especificado mediante el aprovechamiento de la manipulaci\u00f3n incorrecta del par\u00e1metro \"hide unreadable\"."}], "id": "CVE-2013-0454", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-03-26T21:55:01.100", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"}, {"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www.ubuntu.com/usn/USN-1802-1"}, {"source": "psirt@us.ibm.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"}, {"source": "psirt@us.ibm.com", "url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"}, {"source": "psirt@us.ibm.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"}, {"source": "psirt@us.ibm.com", "url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"}, {"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.samba.org/samba/security/CVE-2013-0454"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004289"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.ubuntu.com/usn/USN-1802-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.samba.org/show_bug.cgi?id=8738"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80970"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.samba.org/archive/samba-announce/2012/000259.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.samba.org/samba/security/CVE-2013-0454"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "samba: the SMB2 server does not release unused shares", "id": "928419", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=928419"}, "csaw": false, "cvss": {"cvss_base_score": "3.8", "cvss_scoring_vector": "AV:A/AC:M/Au:S/C:P/I:P/A:N", "status": "draft"}, "details": ["The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or \"hide unreadable\" parameter."], "name": "CVE-2013-0454", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "samba3x", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "samba4", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2012-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-0454\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-0454\nhttps://www.samba.org/samba/security/CVE-2013-0454"], "statement": "Not vulnerable. This issue did not affect the versions of samba as shipped with Red Hat Enterprise Linux 5 as they did not provide support for SMB2. This issue did not affect the versions of samba3x and samba as shipped with Red Hat Enterprise Linux 6 as they ship newer versions that do not include the vulnerable code.", "threat_severity": "Moderate"}

{}