CVE-2013-4476
published 2013-11-13CVE-2013-4476: Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local…
PriorityP45low1.2CVSS 2.0
AVLACHAuNCPINAN
EPSS
0.43%
35.6th percentile
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.0.11+dfsg-1 (bookworm) | samba 2:4.0.11+dfsg-1 (bookworm) |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | >= 0 < 2:4.0.11+dfsg-1 | 2:4.0.11+dfsg-1 |
| samba | samba | >= 0 < 2:4.0.11+dfsg-1 | 2:4.0.11+dfsg-1 |
| samba | samba | >= 0 < 2:4.0.11+dfsg-1 | 2:4.0.11+dfsg-1 |
| samba | samba | >= 0 < 2:4.0.11+dfsg-1 | 2:4.0.11+dfsg-1 |
CVSS provenance
nvdv2.01.2LOWAV:L/AC:H/Au:N/C:P/I:N/A:N
osv1.2LOW
vendor_debian1.2LOW
vendor_redhat1.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r2wh-x73f-g4qw: Samba 4
ghsa_unreviewed·2022-05-17
CVE-2013-4476 [LOW] GHSA-r2wh-x73f-g4qw: Samba 4
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
OSV
CVE-2013-4476: Samba 4
osv·2013-11-13·CVSS 1.2
CVE-2013-4476 [LOW] CVE-2013-4476: Samba 4
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Red Hat
samba: world-readable key.pem with Samba 4 AD DC
vendor_redhat·2013-11-11·CVSS 1.2
CVE-2013-4476 [LOW] samba: world-readable key.pem with Samba 4 AD DC
samba: world-readable key.pem with Samba 4 AD DC
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Statement: Not vulnerable. This issue did not affect the versions of samba or samba3x as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for acting as an Active Directory Domain Controller.
Package: samba (Red Hat Enterprise Linux 5) - Not affected
Package: samba3x (Red Hat Enterprise Linux 5) - Not affected
Package: samba (Red Hat Enterprise Linux 6) - Not affected
Package: samba (Red Hat Enterprise Linux 7) -
Debian
CVE-2013-4476: samba - Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided ...
vendor_debian·2013·CVSS 1.2
CVE-2013-4476 [LOW] CVE-2013-4476: samba - Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided ...
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Scope: local
bookworm: resolved (fixed in 2:4.0.11+dfsg-1)
bullseye: resolved (fixed in 2:4.0.11+dfsg-1)
forky: resolved (fixed in 2:4.0.11+dfsg-1)
sid: resolved (fixed in 2:4.0.11+dfsg-1)
trixie: resolved (fixed in 2:4.0.11+dfsg-1)
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-updates/2013-11/msg00083.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00088.htmlhttp://security.gentoo.org/glsa/glsa-201502-15.xmlhttp://www.samba.org/samba/history/samba-4.0.11.htmlhttp://www.samba.org/samba/history/samba-4.1.1.htmlhttp://www.samba.org/samba/security/CVE-2013-4476http://lists.opensuse.org/opensuse-updates/2013-11/msg00083.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00088.htmlhttp://security.gentoo.org/glsa/glsa-201502-15.xmlhttp://www.samba.org/samba/history/samba-4.0.11.htmlhttp://www.samba.org/samba/history/samba-4.1.1.htmlhttp://www.samba.org/samba/security/CVE-2013-4476
2013-11-13
Published