what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 9 of 9 RSS Feed

CVE-2011-2522

Status Candidate

Overview

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.

Related Files

HP Security Bulletin HPSBUX02768 SSRT100664
Posted Apr 24, 2012
Authored by HP | Site hp.com

HP Security Bulletin HPSBUX02768 SSRT100664 - Potential security vulnerabilities have been identified with HP-UX CIFS-Server (Samba). The vulnerabilities could be exploited remotely to create a cross site request forgery (CSRF) or create a Denial of Service (DoS). Revision 1 of this advisory.

tags | advisory, denial of service, vulnerability, csrf
systems | hpux
advisories | CVE-2011-2522
SHA-256 | 2210c7cd836543d508024ad2841fa47be4cc200493fb1438f0ec0ba35ad7c8e8
Red Hat Security Advisory 2011-1221-01
Posted Aug 30, 2011
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1221-01 - Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS shares. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.

tags | advisory, remote, web, arbitrary, xss, csrf
systems | linux, redhat
advisories | CVE-2011-1678, CVE-2011-2522, CVE-2011-2694, CVE-2011-2724
SHA-256 | 90ff6ef7c2e842e981186930845585a4ce7a06a0da969f9a3f5f611b5d11de4b
Red Hat Security Advisory 2011-1220-01
Posted Aug 29, 2011
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1220-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.

tags | advisory, remote, web, arbitrary, xss, csrf
systems | linux, redhat
advisories | CVE-2011-1678, CVE-2011-2522, CVE-2011-2694, CVE-2011-2724
SHA-256 | e9760fd558188de1a54f0616b4447ef1e4c3f61dd8e0e4e962b255930a150ba0
Red Hat Security Advisory 2011-1219-01
Posted Aug 29, 2011
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1219-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.

tags | advisory, remote, web, arbitrary, xss, csrf
systems | linux, redhat
advisories | CVE-2010-0547, CVE-2010-0787, CVE-2011-1678, CVE-2011-2522, CVE-2011-2694
SHA-256 | 5937696c9bd55e106006e37ce7137dfe26a1fa85701c6b3b20738adf722591c2
Debian Security Advisory 2290-1
Posted Aug 8, 2011
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2290-1 - The Samba Web Administration Tool (SWAT) contains several cross-site request forgery (CSRF) vulnerabilities and a cross-site scripting vulnerability.

tags | advisory, web, vulnerability, xss, csrf
systems | linux, debian
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | 96f9ce74eef52bacf3f7061ab224957bca366e7348aa57791d85df4015342220
Ubuntu Security Notice USN-1182-1
Posted Aug 3, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1182-1 - Yoshihiro Ishikawa discovered that the Samba Web Administration Tool (SWAT) was vulnerable to cross-site request forgeries (CSRF). If a Samba administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the Samba configuration. Nobuhiro Tsuji discovered that the Samba Web Administration Tool (SWAT) did not properly sanitize its input when processing password change requests, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

tags | advisory, remote, web, vulnerability, xss
systems | linux, ubuntu
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | b5365411c65e521113377455a95fb0f5eb3b5f1438e32a7b5c8c7fb63e1875c2
Slackware Security Advisory - samba Updates
Posted Aug 1, 2011
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New samba packages are available for Slackware 13.1, 13.37, and current to address security issues.

tags | advisory
systems | linux, slackware
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | ad736e02a1faa7b1a66f7f92afd3fe2d36657d7e5c08aaaf3f37a36a615bc166
Mandriva Linux Security Advisory 2011-121
Posted Jul 27, 2011
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-121 - All current released versions of Samba are vulnerable to a cross-site request forgery in the Samba Web Administration Tool (SWAT). By tricking a user who is authenticated with SWAT into clicking a manipulated URL on a different web page, it is possible to manipulate SWAT. All current released versions of Samba are vulnerable to a cross-site scripting issue in the Samba Web Administration Tool (SWAT). On the Change Password field, it is possible to insert arbitrary content into the user field.

tags | advisory, web, arbitrary, xss, csrf
systems | linux, mandriva
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | b75ce3ace75fea8d22a279188ef3184449337cf90f4fe3d331c11300c3a6a118
Samba Web Administration Tool Cross Site Request Forgery
Posted Jul 27, 2011
Authored by Narendra Shinde

SWAT (Samba Web Administration Tool) in Samba versions 3.0.x through 3.5.9 suffers from a cross site request forgery vulnerability.

tags | exploit, web, csrf
advisories | CVE-2011-2522
SHA-256 | d475476bb91d90ae8126882c28a969539769386b49ecf8a69ad974db8e791de9
Page 1 of 1
Back1Next

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close