Vulnerability Description
The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | >= 3.2.0, < 4.1.23 |
| Canonical | Ubuntu Linux | 12.04 |
| Debian | Debian Linux | 7.0 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.htmlMailing ListThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.htmlMailing ListThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlMailing ListThird Party Advisory
- http://www.debian.org/security/2016/dsa-3514Third Party Advisory
- http://www.securityfocus.com/bid/84267Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1035220Third Party AdvisoryVDB Entry
FAQ
What is CVE-2015-7560?
CVE-2015-7560 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by usin...
How severe is CVE-2015-7560?
CVE-2015-7560 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7560?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba, Canonical Ubuntu Linux, Debian Debian Linux.