Vulnerability Details : CVE-2013-4476
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Exploit prediction scoring system (EPSS) score for CVE-2013-4476
Probability of exploitation activity in the next 30 days: 0.06%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 23 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-4476
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
1.2
|
LOW | AV:L/AC:H/Au:N/C:P/I:N/A:N |
1.9
|
2.9
|
NIST |
CWE ids for CVE-2013-4476
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4476
-
http://www.samba.org/samba/history/samba-4.1.1.html
Samba - Release Notes Archive
-
http://lists.opensuse.org/opensuse-updates/2013-11/msg00083.html
openSUSE-SU-2013:1742-1: moderate: samba: security and bugfix update
-
http://security.gentoo.org/glsa/glsa-201502-15.xml
Samba: Multiple vulnerabilities (GLSA 201502-15) — Gentoo security
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.html
openSUSE-SU-2013:1921-1: moderate: update for samba
-
http://www.samba.org/samba/history/samba-4.0.11.html
Samba - Release Notes Archive
-
http://www.samba.org/samba/security/CVE-2013-4476
Samba - Security Announcement ArchiveVendor Advisory
Products affected by CVE-2013-4476
- cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*