Vulnerability Description
The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode, leading to a character-set conversion failure that triggers an invalid pointer dereference.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | 3.6.0 |
Related Weaknesses (CWE)
References
- http://advisories.mageia.org/MGASA-2014-0279.html
- http://linux.oracle.com/errata/ELSA-2014-0866.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html
- http://rhn.redhat.com/errata/RHSA-2014-0866.html
- http://secunia.com/advisories/59378
- http://secunia.com/advisories/59407
- http://secunia.com/advisories/59433
- http://secunia.com/advisories/59579
- http://secunia.com/advisories/59834
- http://secunia.com/advisories/59848
- http://secunia.com/advisories/59919
- http://secunia.com/advisories/61218
- http://security.gentoo.org/glsa/glsa-201502-15.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:136
FAQ
What is CVE-2014-3493?
CVE-2014-3493 is a vulnerability with a CVSS score of 2.7 (LOW). The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon c...
How severe is CVE-2014-3493?
CVE-2014-3493 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-3493?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba.