CVE-2009-2948

Description

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

Weakness classification

• CWE-732: Incorrect Permission Assignment for Critical Resource

Primary references

• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Broken Link, Vendor Advisory
• cve@mitre.org — Broken Link, Vendor Advisory
• cve@mitre.org — Broken Link, Vendor Advisory
• cve@mitre.org — Broken Link, Vendor Advisory
• cve@mitre.org — Broken Link
• cve@mitre.org — Not Applicable, Vendor Advisory
• cve@mitre.org — Not Applicable, Vendor Advisory
• cve@mitre.org — Not Applicable, Vendor Advisory
• cve@mitre.org — Not Applicable, Vendor Advisory
• cve@mitre.org — Patch, Third Party Advisory
• cve@mitre.org — Patch, Vendor Advisory