CVE-2014-0178

CVSS V2 Low 3.5 CVSS V3 None
Description
Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.
Overview
  • CVE ID
  • CVE-2014-0178
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2014-05-28T04:58:32
  • Last Modified Date
  • 2022-09-01T16:34:34
Weakness Enumerations
CWE URL
CWE-665 http://cwe.mitre.org/data/definitions/665.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* 1 OR 3.6.6 3.6.25
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* 1 OR 4.0.0 4.0.18
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* 1 OR 4.1.0 4.1.8
cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.21:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.22:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:samba:samba:3.6.23:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:S/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 3.5
  • Severity
  • LOW
  • Exploitability Score
  • 6.8
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.samba.org/samba/security/CVE-2014-0178 Vendor Advisory
http://advisories.mageia.org/MGASA-2014-0279.html
http://secunia.com/advisories/59579
http://secunia.com/advisories/59378
http://www.mandriva.com/security/advisories?name=MDVSA-2014:136
http://security.gentoo.org/glsa/glsa-201502-15.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2015:082
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993
http://www.securitytracker.com/id/1030308
http://www.securityfocus.com/bid/67686
http://secunia.com/advisories/59407
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html
http://www.securityfocus.com/archive/1/532757/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2014-0178
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0178
History
Created Old Value New Value Data Type Notes
2022-05-10 18:35:23 Added to TrackCVE
2022-12-01 23:17:10 2014-05-28T04:58Z 2014-05-28T04:58:32 CVE Published Date updated
2022-12-01 23:17:10 2022-09-01T16:34:34 CVE Modified Date updated
2022-12-01 23:17:10 Analyzed Vulnerability Status updated