Input validation error in samba (Alpine package)

1) Input validation error

EUVDB-ID: #VU32700

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-0213

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element. Per: http://capec.mitre.org/data/definitions/103.html "CAPEC-103: Clickjacking"

Mitigation

Install update from vendor's website.

Vulnerable software versions

samba (Alpine package): 3.4.8-r0 - 3.5.15-r0

CPE2.3

• cpe:2.3:o:alpine:samba_alpine_package:3.4.8-r0:*:*:*:*:alpine_linux:*:1.10
• cpe:2.3:o:alpine:samba_alpine_package:3.5.5-r0:*:*:*:*:alpine_linux:*:2.0
• cpe:2.3:o:alpine:samba_alpine_package:3.5.8-r0:*:*:*:*:alpine_linux:*:2.1

External links

https://git.alpinelinux.org/aports/commit/?id=bd4160cd2286ae71c919500fc00c2abd086b5748
https://git.alpinelinux.org/aports/commit/?id=888aa2414f4c65d63d7c2ce96e37b89919ab130f
https://git.alpinelinux.org/aports/commit/?id=cf72dde25eb0f37eb7721665625baffb5c7f7f39
https://git.alpinelinux.org/aports/commit/?id=1b35107df4166fc7b1bb3303aaeaf5d9445c3e70

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.