CVE-2015-5299 : The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x b

The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.

Published 2015-12-29 22:59:03

Updated 2022-08-29 20:04:08

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2015-5299

Probability of exploitation activity in the next 30 days: 0.57%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 75 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2015-5299

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2015-5299

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-5299

https://security.gentoo.org/glsa/201612-47

Samba: Multiple vulnerabilities (GLSA 201612-47) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.html

[security-announce] SUSE-SU-2016:0164-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3433

Debian -- Security Information -- DSA-3433-1 samba
Third Party Advisory

CVEs referencing this url
https://git.samba.org/?p=samba.git;a=commit;h=675fd8d771f9d43e354dba53ddd9b5483ae0a1d7

git.samba.org - samba.git/commit
Patch;Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html

[security-announce] openSUSE-SU-2015:2354-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

[security-announce] openSUSE-SU-2016:1064-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html

[SECURITY] Fedora 23 Update: samba-4.3.3-0.fc23
Mailing List;Third Party Advisory

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993

HPSBUX03574 rev.1 - HPE HP-UX CIFS-Server (Samba), Remote Access Restriction Bypass, Authentication bypass, Denial of Service (DoS), Unauthorized Access to Files, Access Restriction Bypass, Unauthoriz
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/79729

Samba CVE-2015-5299 Remote Security Bypass Vulnerability
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html

[security-announce] SUSE-SU-2015:2304-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html

[security-announce] openSUSE-SU-2015:2356-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html

[security-announce] SUSE-SU-2015:2305-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html

[SECURITY] Fedora 22 Update: samba-4.2.7-0.fc22
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2855-2

USN-2855-2: Samba regression | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00002.html

[security-announce] SUSE-SU-2016:0032-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Oracle Linux Bulletin - January 2016
Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Oracle Solaris Bulletin - January 2016
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

[security-announce] openSUSE-SU-2016:1106-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1034493

Samba Multiple Flaws Let Remote Users Access Data and Files, Obtain Potentially Sensitive Information, and Deny Service - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1276126

1276126 – (CVE-2015-5299) CVE-2015-5299 Samba: Missing access control check in shadow copy code
Issue Tracking;Third Party Advisory
http://www.ubuntu.com/usn/USN-2855-1

USN-2855-1: Samba vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://www.samba.org/samba/security/CVE-2015-5299.html

Samba - Security Announcement Archive
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

[security-announce] openSUSE-SU-2016:1107-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url

Products affected by CVE-2015-5299

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Samba » Samba
Versions from including (>=) 3.0.20 and before (<) 4.1.22
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Matching versions
Samba » Samba
Versions from including (>=) 4.3.0 and before (<) 4.3.3
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Matching versions
Samba » Samba
Versions from including (>=) 4.2.0 and before (<) 4.2.7
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.04
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2015-5299

Exploit prediction scoring system (EPSS) score for CVE-2015-5299

CVSS scores for CVE-2015-5299

CWE ids for CVE-2015-5299

References for CVE-2015-5299

Products affected by CVE-2015-5299