ID CVE-2014-3560
Summary NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.
References
Vulnerable Configurations
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.8:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.8:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.9:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.9:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.1.10:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.1.10:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:samba:samba:4.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:samba:samba:4.0.20:*:*:*:*:*:*:*
CVSS
Base: 7.9 (as of 22-04-2019 - 17:48)
Impact:
Exploitability:
CWE CWE-94
CAPEC
  • Code Injection
    An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Access
VectorComplexityAuthentication
ADJACENT_NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:A/AC:M/Au:N/C:C/I:C/A:C
redhat via4
advisories
  • bugzilla
    id 1126010
    title CVE-2014-3560 samba: remote code execution in nmbd
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment libsmbclient is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008001
          • comment libsmbclient is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258008
        • AND
          • comment libsmbclient-devel is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008003
          • comment libsmbclient-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258010
        • AND
          • comment libwbclient is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008005
          • comment libwbclient is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258012
        • AND
          • comment libwbclient-devel is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008007
          • comment libwbclient-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258014
        • AND
          • comment samba is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008009
          • comment samba is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258016
        • AND
          • comment samba-client is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008011
          • comment samba-client is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258018
        • AND
          • comment samba-common is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008013
          • comment samba-common is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258022
        • AND
          • comment samba-dc is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008015
          • comment samba-dc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258028
        • AND
          • comment samba-dc-libs is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008017
          • comment samba-dc-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258030
        • AND
          • comment samba-devel is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008019
          • comment samba-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258032
        • AND
          • comment samba-libs is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008021
          • comment samba-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258034
        • AND
          • comment samba-pidl is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008023
          • comment samba-pidl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258036
        • AND
          • comment samba-python is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008025
          • comment samba-python is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258038
        • AND
          • comment samba-test is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008027
          • comment samba-test is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258040
        • AND
          • comment samba-test-devel is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008029
          • comment samba-test-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258042
        • AND
          • comment samba-vfs-glusterfs is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008031
          • comment samba-vfs-glusterfs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258046
        • AND
          • comment samba-winbind is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008033
          • comment samba-winbind is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258048
        • AND
          • comment samba-winbind-clients is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008035
          • comment samba-winbind-clients is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258050
        • AND
          • comment samba-winbind-krb5-locator is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008037
          • comment samba-winbind-krb5-locator is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258052
        • AND
          • comment samba-winbind-modules is earlier than 0:4.1.1-37.el7_0
            oval oval:com.redhat.rhsa:tst:20141008039
          • comment samba-winbind-modules is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152258054
    rhsa
    id RHSA-2014:1008
    released 2014-08-05
    severity Important
    title RHSA-2014:1008: samba security and bug fix update (Important)
  • bugzilla
    id 1126010
    title CVE-2014-3560 samba: remote code execution in nmbd
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment samba4 is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009001
          • comment samba4 is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506002
        • AND
          • comment samba4-client is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009003
          • comment samba4-client is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506004
        • AND
          • comment samba4-common is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009005
          • comment samba4-common is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506006
        • AND
          • comment samba4-dc is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009007
          • comment samba4-dc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506008
        • AND
          • comment samba4-dc-libs is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009009
          • comment samba4-dc-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506010
        • AND
          • comment samba4-devel is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009011
          • comment samba4-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506012
        • AND
          • comment samba4-libs is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009013
          • comment samba4-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506014
        • AND
          • comment samba4-pidl is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009015
          • comment samba4-pidl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506016
        • AND
          • comment samba4-python is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009017
          • comment samba4-python is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506018
        • AND
          • comment samba4-swat is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009019
          • comment samba4-swat is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506020
        • AND
          • comment samba4-test is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009021
          • comment samba4-test is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506022
        • AND
          • comment samba4-winbind is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009023
          • comment samba4-winbind is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506024
        • AND
          • comment samba4-winbind-clients is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009025
          • comment samba4-winbind-clients is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506026
        • AND
          • comment samba4-winbind-krb5-locator is earlier than 0:4.0.0-63.el6_5.rc4
            oval oval:com.redhat.rhsa:tst:20141009027
          • comment samba4-winbind-krb5-locator is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20130506028
    rhsa
    id RHSA-2014:1009
    released 2014-08-05
    severity Important
    title RHSA-2014:1009: samba4 security update (Important)
rpms
  • libsmbclient-0:4.1.1-37.el7_0
  • libsmbclient-devel-0:4.1.1-37.el7_0
  • libwbclient-0:4.1.1-37.el7_0
  • libwbclient-devel-0:4.1.1-37.el7_0
  • samba-0:4.1.1-37.el7_0
  • samba-client-0:4.1.1-37.el7_0
  • samba-common-0:4.1.1-37.el7_0
  • samba-dc-0:4.1.1-37.el7_0
  • samba-dc-libs-0:4.1.1-37.el7_0
  • samba-debuginfo-0:4.1.1-37.el7_0
  • samba-devel-0:4.1.1-37.el7_0
  • samba-libs-0:4.1.1-37.el7_0
  • samba-pidl-0:4.1.1-37.el7_0
  • samba-python-0:4.1.1-37.el7_0
  • samba-test-0:4.1.1-37.el7_0
  • samba-test-devel-0:4.1.1-37.el7_0
  • samba-vfs-glusterfs-0:4.1.1-37.el7_0
  • samba-winbind-0:4.1.1-37.el7_0
  • samba-winbind-clients-0:4.1.1-37.el7_0
  • samba-winbind-krb5-locator-0:4.1.1-37.el7_0
  • samba-winbind-modules-0:4.1.1-37.el7_0
  • samba4-0:4.0.0-63.el6_5.rc4
  • samba4-client-0:4.0.0-63.el6_5.rc4
  • samba4-common-0:4.0.0-63.el6_5.rc4
  • samba4-dc-0:4.0.0-63.el6_5.rc4
  • samba4-dc-libs-0:4.0.0-63.el6_5.rc4
  • samba4-debuginfo-0:4.0.0-63.el6_5.rc4
  • samba4-devel-0:4.0.0-63.el6_5.rc4
  • samba4-libs-0:4.0.0-63.el6_5.rc4
  • samba4-pidl-0:4.0.0-63.el6_5.rc4
  • samba4-python-0:4.0.0-63.el6_5.rc4
  • samba4-swat-0:4.0.0-63.el6_5.rc4
  • samba4-test-0:4.0.0-63.el6_5.rc4
  • samba4-winbind-0:4.0.0-63.el6_5.rc4
  • samba4-winbind-clients-0:4.0.0-63.el6_5.rc4
  • samba4-winbind-krb5-locator-0:4.0.0-63.el6_5.rc4
refmap via4
bid 69021
confirm
fedora
  • FEDORA-2014-9132
  • FEDORA-2014-9141
sectrack 1030663
secunia
  • 59583
  • 59610
  • 59976
suse openSUSE-SU-2014:1040
ubuntu USN-2305-1
xf samba-cve20143560-bo(95081)
Last major update 22-04-2019 - 17:48
Published 06-08-2014 - 18:55
Last modified 22-04-2019 - 17:48
Back to Top