CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
AI Score
Confidence
Low
EPSS
Percentile
74.2%
ACLs are not checked on opening an alternate data stream on a
file or directory.
# Copyright (C) 2021 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
CPE = "cpe:/a:samba:samba";
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.150744");
script_version("2023-10-12T05:05:32+0000");
script_tag(name:"last_modification", value:"2023-10-12 05:05:32 +0000 (Thu, 12 Oct 2023)");
script_tag(name:"creation_date", value:"2021-09-24 10:59:30 +0000 (Fri, 24 Sep 2021)");
script_tag(name:"cvss_base", value:"4.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:H/Au:N/C:P/I:P/A:N");
script_cve_id("CVE-2013-4475");
script_tag(name:"qod_type", value:"remote_banner_unreliable");
script_tag(name:"solution_type", value:"VendorFix");
script_name("Samba >= 3.2.0 Bypass File Restriction Vulnerability (CVE-2013-4475)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2021 Greenbone Networks GmbH");
script_family("General");
script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
script_mandatory_keys("samba/smb_or_ssh/detected");
script_tag(name:"summary", value:"ACLs are not checked on opening an alternate data stream on a
file or directory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");
script_tag(name:"insight", value:"Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
file or directory ACL when opening an alternate data stream.
According to the SMB1 and SMB2+ protocols the ACL on an underlying
file or directory should control what access is allowed to alternate
data streams that are associated with the file or directory.
By default no version of Samba supports alternate data streams
on files or directories.
Samba can be configured to support alternate data streams by loading
either one of two virtual file system modules (VFS) vfs_streams_depot or
vfs_streams_xattr supplied with Samba, so this bug only affects Samba
servers configured this way.
To determine if your server is vulnerable, check for the strings
'streams_depot' or 'streams_xattr' inside your smb.conf configuration
file.");
script_tag(name:"affected", value:"Samba versions 3.2.0 through 3.6.19, 4.0.0 through 4.0.10 and
4.1.0.");
script_tag(name:"solution", value:"Update to version 3.6.20, 4.0.11, 4.1.1 or later.");
script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2013-4475.html");
exit(0);
}
include("host_details.inc");
include("version_func.inc");
if (isnull(port = get_app_port(cpe: CPE)))
exit(0);
if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
exit(0);
version = infos["version"];
location = infos["location"];
if (version_in_range(version: version, test_version: "3.2.0", test_version2: "3.6.19")) {
report = report_fixed_ver(installed_version: version, fixed_version: "3.6.20", install_path: location);
security_message(port: port, data: report);
exit(0);
}
if (version_in_range(version: version, test_version: "4.0.0", test_version2: "4.0.10")) {
report = report_fixed_ver(installed_version: version, fixed_version: "4.0.11", install_path: location);
security_message(port: port, data: report);
exit(0);
}
if (version_is_equal(version: version, test_version: "4.1.0")) {
report = report_fixed_ver(installed_version: version, fixed_version: "4.1.1", install_path: location);
security_message(port: port, data: report);
exit(0);
}
exit(99);