CVE-2014-0178

Priority
Medium
Description
Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8,
when a certain vfs shadow copy configuration is enabled, does not properly
initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote
authenticated users to obtain potentially sensitive information from
process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2)
FSCTL_SRV_ENUMERATE_SNAPSHOTS request.
References
Assigned-to
mdeslaur
Package
Upstream:released (3.6.23,4.0.18,4.1.8)
Ubuntu 10.04 LTS (Lucid Lynx):ignored (reached end-of-life)
Ubuntu 12.04 LTS (Precise Pangolin):needed
Ubuntu 14.04 LTS (Trusty Tahr):DNE
Ubuntu 14.10 (Utopic Unicorn):DNE
Package
Source: samba (LP Ubuntu Debian)
Upstream:released (3.6.23,4.0.18,4.1.8)
Ubuntu 10.04 LTS (Lucid Lynx):not-affected (code not present)
Ubuntu 12.04 LTS (Precise Pangolin):not-affected (code not present)
Ubuntu 14.04 LTS (Trusty Tahr):released (2:4.1.6+dfsg-1ubuntu2.14.04.2)
Ubuntu 14.10 (Utopic Unicorn):not-affected (2:4.1.8+dfsg-1ubuntu1)
Patches:
Upstream:http://git.samba.org/?p=samba.git;a=commit;h=ab51cd90a077c2938620afedc61e2da21cb509be (4.x)
Upstream:http://git.samba.org/?p=samba.git;a=commit;h=dbe2ef7f66c4c5cde1e1300675fcb78f4de3af70 (4.x)
More Information

Valid XHTML 1.0 Strict

Updated: 2014-10-23 21:18:17 UTC (commit 8644)