CVE-2009-1888

Published: Jun 25, 2009Modified: Apr 23, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.

Affected (9)

Products: Samba: Samba · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Samba Samba	From 3.0.31 to 3.0.35
Samba Samba	From 3.2.0 to 3.2.13
Samba Samba	From 3.3.0 to 3.3.6

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04

Related CWEs

CWE-264

References (40)

http://secunia.com/advisories/35539

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35573

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35606

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/36918

Source: secalert@redhat.com

Third Party Advisory

http://wiki.rpath.com/Advisories:rPSA-2009-0145

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1823

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:196

Source: secalert@redhat.com

Third Party Advisory

http://www.samba.org/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch

Source: secalert@redhat.com

ExploitPatchVendor Advisory

http://www.samba.org/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch

Source: secalert@redhat.com

PatchVendor Advisory

http://www.samba.org/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch

Source: secalert@redhat.com

PatchVendor Advisory

http://www.samba.org/samba/security/CVE-2009-1888.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.securityfocus.com/archive/1/507856/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/35472

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1022442

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-839-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1664

Source: secalert@redhat.com

Permissions RequiredThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/51327

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10790

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7292

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35539