CVE-2013-4496

published 2014-03-14

CVE-2013-4496: Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which…

Priority P4 32 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
debian	samba	< samba 2:4.1.6+dfsg-1 (bookworm)	samba 2:4.1.6+dfsg-1 (bookworm)
samba	samba	>= 0 < 2:4.1.6+dfsg-1	2:4.1.6+dfsg-1
samba	samba	>= 0 < 2:4.1.6+dfsg-1	2:4.1.6+dfsg-1
samba	samba	>= 0 < 2:4.1.6+dfsg-1	2:4.1.6+dfsg-1
samba	samba	>= 0 < 2:4.1.6+dfsg-1	2:4.1.6+dfsg-1
samba	samba	>= 3.4.0 < 3.6.23	3.6.23
samba	samba	>= 4.0.0 < 4.0.16	4.0.16
samba	samba	>= 4.1.0 < 4.1.6	4.1.6

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

osv 5.0 MEDIUM

vendor_debian 5.0 LOW

vendor_redhat 5.0 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-255