exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 7 of 7 RSS Feed

CVE-2011-2694

Status Candidate

Overview

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).

Related Files

Red Hat Security Advisory 2011-1221-01
Posted Aug 30, 2011
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1221-01 - Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS shares. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.

tags | advisory, remote, web, arbitrary, xss, csrf
systems | linux, redhat
advisories | CVE-2011-1678, CVE-2011-2522, CVE-2011-2694, CVE-2011-2724
SHA-256 | 90ff6ef7c2e842e981186930845585a4ce7a06a0da969f9a3f5f611b5d11de4b
Red Hat Security Advisory 2011-1220-01
Posted Aug 29, 2011
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1220-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.

tags | advisory, remote, web, arbitrary, xss, csrf
systems | linux, redhat
advisories | CVE-2011-1678, CVE-2011-2522, CVE-2011-2694, CVE-2011-2724
SHA-256 | e9760fd558188de1a54f0616b4447ef1e4c3f61dd8e0e4e962b255930a150ba0
Red Hat Security Advisory 2011-1219-01
Posted Aug 29, 2011
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1219-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.

tags | advisory, remote, web, arbitrary, xss, csrf
systems | linux, redhat
advisories | CVE-2010-0547, CVE-2010-0787, CVE-2011-1678, CVE-2011-2522, CVE-2011-2694
SHA-256 | 5937696c9bd55e106006e37ce7137dfe26a1fa85701c6b3b20738adf722591c2
Debian Security Advisory 2290-1
Posted Aug 8, 2011
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2290-1 - The Samba Web Administration Tool (SWAT) contains several cross-site request forgery (CSRF) vulnerabilities and a cross-site scripting vulnerability.

tags | advisory, web, vulnerability, xss, csrf
systems | linux, debian
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | 96f9ce74eef52bacf3f7061ab224957bca366e7348aa57791d85df4015342220
Ubuntu Security Notice USN-1182-1
Posted Aug 3, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1182-1 - Yoshihiro Ishikawa discovered that the Samba Web Administration Tool (SWAT) was vulnerable to cross-site request forgeries (CSRF). If a Samba administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the Samba configuration. Nobuhiro Tsuji discovered that the Samba Web Administration Tool (SWAT) did not properly sanitize its input when processing password change requests, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

tags | advisory, remote, web, vulnerability, xss
systems | linux, ubuntu
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | b5365411c65e521113377455a95fb0f5eb3b5f1438e32a7b5c8c7fb63e1875c2
Slackware Security Advisory - samba Updates
Posted Aug 1, 2011
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New samba packages are available for Slackware 13.1, 13.37, and current to address security issues.

tags | advisory
systems | linux, slackware
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | ad736e02a1faa7b1a66f7f92afd3fe2d36657d7e5c08aaaf3f37a36a615bc166
Mandriva Linux Security Advisory 2011-121
Posted Jul 27, 2011
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-121 - All current released versions of Samba are vulnerable to a cross-site request forgery in the Samba Web Administration Tool (SWAT). By tricking a user who is authenticated with SWAT into clicking a manipulated URL on a different web page, it is possible to manipulate SWAT. All current released versions of Samba are vulnerable to a cross-site scripting issue in the Samba Web Administration Tool (SWAT). On the Change Password field, it is possible to insert arbitrary content into the user field.

tags | advisory, web, arbitrary, xss, csrf
systems | linux, mandriva
advisories | CVE-2011-2522, CVE-2011-2694
SHA-256 | b75ce3ace75fea8d22a279188ef3184449337cf90f4fe3d331c11300c3a6a118
Page 1 of 1
Back1Next

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    9 Files
  • 30
    Nov 30th
    21 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close