Samba SWAT Cross Site Request Forgery and Clickjacking Vulnerabilities
BID:57631
Info
Samba SWAT Cross Site Request Forgery and Clickjacking Vulnerabilities
| Bugtraq ID: | 57631 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-0213 CVE-2013-0214 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 30 2013 12:00AM |
| Updated: | Jul 06 2016 02:38PM |
| Credit: | Jann Horn |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server for VMware 11 SP2 SuSE SUSE Linux Enterprise Server 11 SP2 SuSE SUSE Linux Enterprise Server 10 GPLv3 Extras SuSE SUSE Linux Enterprise SDK 11 SP2 SuSE SUSE Linux Enterprise Desktop 11 SP2 Sun Solaris 11 Samba Samba 3.6.4 Samba Samba 3.6.3 Samba Samba 3.6.2 Samba Samba 3.6.1 Samba Samba 3.6 Samba Samba 3.5.9 Samba Samba 3.5.8 Samba Samba 3.5.2 Samba Samba 3.5.1 Samba Samba 3.5 Samba Samba 3.4.14 Samba Samba 3.4.13 Samba Samba 3.4.12 Samba Samba 3.4.11 Samba Samba 3.4.10 Samba Samba 3.4.8 Samba Samba 3.4.7 Samba Samba 3.4.6 Samba Samba 3.4.5 Samba Samba 3.4.2 Samba Samba 3.4.1 Samba Samba 3.4 Samba Samba 3.3.16 Samba Samba 3.3.15 Samba Samba 3.3.14 Samba Samba 3.3.13 Samba Samba 3.3.12 Samba Samba 3.3.11 Samba Samba 3.3.10 Samba Samba 3.3.9 Samba Samba 3.3.8 Samba Samba 3.3.7 Samba Samba 3.3.6 Samba Samba 3.3.5 Samba Samba 3.3.4 Samba Samba 3.3.3 Samba Samba 3.3.1 Samba Samba 3.3 Samba Samba 3.2.15 Samba Samba 3.2.14 Samba Samba 3.2.13 Samba Samba 3.2.12 Samba Samba 3.2.11 Samba Samba 3.2.10 Samba Samba 3.2.7 Samba Samba 3.2.6 Samba Samba 3.2.5 Samba Samba 3.2.4 Samba Samba 3.2.3 Samba Samba 3.2.2 Samba Samba 3.2.1 Samba Samba 3.2 Samba Samba 3.0.37 Samba Samba 3.0.36 Samba Samba 3.0.35 Samba Samba 3.0.34 Samba Samba 3.0.33 Samba Samba 3.0.32 Samba Samba 3.0.31 Samba Samba 3.0.30 Samba Samba 3.0.29 Samba Samba 3.0.28 a Samba Samba 3.0.28 a Samba Samba 3.0.28 Samba Samba 3.0.27 Samba Samba 3.0.26 Samba Samba 3.0.25 rc3 Samba Samba 3.0.25 rc2 Samba Samba 3.0.25 rc1 Samba Samba 3.0.25 pre2 Samba Samba 3.0.25 pre1 Samba Samba 3.0.25 c Samba Samba 3.0.25 b Samba Samba 3.0.25 a Samba Samba 3.0.25 Samba Samba 3.0.24 Samba Samba 3.0.23 Samba Samba 3.0.22 Samba Samba 3.0.21 Samba Samba 3.0.20 Samba Samba 3.0.19 Samba Samba 3.0.18 Samba Samba 3.0.17 Samba Samba 3.0.16 Samba Samba 3.0.15 Samba Samba 3.0.14 Samba Samba 3.0.13 Samba Samba 3.0.12 Samba Samba 3.0.11 Samba Samba 3.0.10 Samba Samba 3.0.9 Samba Samba 3.0.8 Samba Samba 3.0.7 Samba Samba 3.0.6 Samba Samba 3.0.5 Samba Samba 3.0.4 -r1 Samba Samba 3.0.4 Samba Samba 3.0.3 Samba Samba 3.0.2 a Samba Samba 3.0.2 Samba Samba 3.0.1 Samba Samba 3.0 alpha Samba Samba 3.0 Samba Samba 4.0.0tp5 Samba Samba 3.6.5 Samba Samba 3.5.7 Samba Samba 3.5.6 Samba Samba 3.5.5 Samba Samba 3.5.4 Samba Samba 3.5.3 Samba Samba 3.5.15 Samba Samba 3.5.14 Samba Samba 3.5.11 Samba Samba 3.5.10 Samba Samba 3.5 Samba Samba 3.4.9 Samba Samba 3.4.4 Samba Samba 3.4.3 Samba Samba 3.4.17 Samba Samba 3.4.16 Samba Samba 3.3.2 Samba Samba 3.2.9 Samba Samba 3.2.8 Samba Samba 3.1 Samba Samba 3.0.27a Samba Samba 3.0.26a Samba Samba 3.0.23d Samba Samba 3.0.23c Samba Samba 3.0.23b Samba Samba 3.0.23a Samba Samba 3.0.21c Samba Samba 3.0.21b Samba Samba 3.0.21a Samba Samba 3.0.20b Samba Samba 3.0.20a Samba Samba 3.0.14a Samba Samba 3.0.0 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 5 |
| Not Vulnerable: | |
Discussion
Samba SWAT Cross Site Request Forgery and Clickjacking Vulnerabilities
Samba is prone to a cross-site request forgery vulnerability and a clickjacking vulnerability.
Attackers can exploit these issues to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.
Samba versions 3.0 through 4.0.1 are vulnerable.
Samba is prone to a cross-site request forgery vulnerability and a clickjacking vulnerability.
Attackers can exploit these issues to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.
Samba versions 3.0 through 4.0.1 are vulnerable.
Exploit / POC
Samba SWAT Cross Site Request Forgery and Clickjacking Vulnerabilities
An attacker can use a web browser to exploit these issues. To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into visiting a malicious site.
An attacker can use a web browser to exploit these issues. To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into visiting a malicious site.
References
Samba SWAT Cross Site Request Forgery and Clickjacking Vulnerabilities
References:
References:
- CVE-2013-0213: Clickjacking in SWAT (Samba)
- CVE-2013-0214: Cross-Site Request Forgery in SWAT (Samba)
- Multiple vulnerabilities in Samba Web Administration Tool (SWAT) (Oracle)
- Samba Homepage (Samba)
- HPSBUX03574 rev.1 - HPE HP-UX CIFS-Server (Samba), Remote Access Restriction Byp (HP)
- SA51994: Samba SWAT Clickjacking Vulnerability (Samba)
- samba security, bug fix, and enhancement update (RHSA-2013-1542) (Avaya)
- Xerox Security Bulletin XRX13-007 (Xerox)