CVE-2011-2522

CVE Details

Release Date:

2011-07-29

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.

See more information about CVE-2011-2522 from MITRE CVE dictionary and NIST NVD

CVSS v2.0 metrics

NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score:	6.8	Base Metrics:	AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector:	Network	Attack Complexity:	Medium
Authentication:	None required	Confidentiality Impact:	Partial
Integrity Impact:	Partial	Availability Impact:	Partial

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 4 (samba)	ELSA-2011-1219	2011-08-29
Oracle Linux version 5 (samba)	ELSA-2011-1219	2011-08-29
Oracle Linux version 5 (samba3x)	ELSA-2011-1220	2011-08-29
Oracle Linux version 6 (cifs-utils)	ELSA-2011-1221	2011-08-29
Oracle Linux version 6 (samba)	ELSA-2011-1221	2011-08-29

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team