CVE-2009-2948

NameCVE-2009-2948
Descriptionmount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1908-1
Debian Bugs550423

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
samba (PTS)buster, buster (security)2:4.9.5+dfsg-5+deb10u3fixed
bullseye (security), bullseye2:4.13.13+dfsg-1~deb11u5fixed
bookworm, sid2:4.16.5+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sambasourcelenny2:3.2.5-4lenny7DSA-1908-1
sambasource(unstable)2:3.4.2-1medium550423
Search for package or bug name: Reporting problems