CVE-2013-4476

2013-11-1315:55:03

CWE-310

redhat

web.nvd.nist.gov

samba

ssl

ldap

http

security vulnerability

cve-2013-4476

CVSS2

1.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:N/A:N

AI Score

5.7

Confidence

Low

EPSS

0.001

Percentile

25.3%

JSON

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.

Affected configurations

Nvd

Node

sambasambaMatch4.0.0

sambasambaMatch4.0.1

sambasambaMatch4.0.2

sambasambaMatch4.0.3

sambasambaMatch4.0.4

sambasambaMatch4.0.5

sambasambaMatch4.0.6

sambasambaMatch4.0.7

sambasambaMatch4.0.8

sambasambaMatch4.0.9

sambasambaMatch4.0.10

sambasambaMatch4.1.0

VendorProductVersionCPE
sambasamba4.0.6cpe:/a:samba:samba:4.0.6:::
sambasamba4.0.1cpe:/a:samba:samba:4.0.1:::
sambasamba4.0.7cpe:/a:samba:samba:4.0.7:::
sambasamba4.0.0cpe:/a:samba:samba:4.0.0:::
sambasamba4.0.8cpe:/a:samba:samba:4.0.8:::
sambasamba4.0.2cpe:/a:samba:samba:4.0.2:::
sambasamba4.0.4cpe:/a:samba:samba:4.0.4:::
sambasamba4.0.3cpe:/a:samba:samba:4.0.3:::
sambasamba4.0.10cpe:/a:samba:samba:4.0.10:::
sambasamba4.0.5cpe:/a:samba:samba:4.0.5:::

Vendor	Product	Version	CPE
samba	samba	4.0.6	cpe:/a:samba:samba:4.0.6:::
samba	samba	4.0.1	cpe:/a:samba:samba:4.0.1:::
samba	samba	4.0.7	cpe:/a:samba:samba:4.0.7:::
samba	samba	4.0.0	cpe:/a:samba:samba:4.0.0:::
samba	samba	4.0.8	cpe:/a:samba:samba:4.0.8:::
samba	samba	4.0.2	cpe:/a:samba:samba:4.0.2:::
samba	samba	4.0.4	cpe:/a:samba:samba:4.0.4:::
samba	samba	4.0.3	cpe:/a:samba:samba:4.0.3:::
samba	samba	4.0.10	cpe:/a:samba:samba:4.0.10:::
samba	samba	4.0.5	cpe:/a:samba:samba:4.0.5:::