FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-4475

This CVE name corresponds to:

Entered	Topic
2013-11-19	samba -- ACLs are not checked on opening an alternate data stream on a file or directory

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-4475 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-4475
Phase	Assigned(20130612)

Description

Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).

References

Source	Reference
CONFIRM	http://www.samba.org/samba/history/samba-3.6.20.html
CONFIRM	http://www.samba.org/samba/history/samba-4.0.11.html
CONFIRM	http://www.samba.org/samba/history/samba-4.1.1.html
CONFIRM	http://www.samba.org/samba/security/CVE-2013-4475
CONFIRM	https://blogs.oracle.com/sunsecurity/entry/cve_2013_4475_access_control
CONFIRM	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993
DEBIAN	DSA-2812
GENTOO	GLSA-201502-15
REDHAT	RHSA-2013:1806
REDHAT	RHSA-2014:0009
SUSE	openSUSE-SU-2013:1742
SUSE	openSUSE-SU-2013:1787
SUSE	openSUSE-SU-2013:1790
SUSE	openSUSE-SU-2013:1921
SUSE	SUSE-SU-2014:0024
UBUNTU	USN-2054-1
BID	63646
SECUNIA	56508