CVE-2013-4476

NameCVE-2013-4476
DescriptionSamba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
samba (PTS)bullseye (security), bullseye2:4.13.13+dfsg-1~deb11u6fixed
bookworm, bookworm (security)2:4.17.12+dfsg-0+deb12u1fixed
sid, trixie2:4.21.1+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sambasourcesqueeze(not affected)
sambasourcewheezy(not affected)
sambasource(unstable)2:4.0.11+dfsg-1low
samba4sourcewheezy4.0.0~beta2+dfsg1-3.2+deb7u1
samba4source(unstable)(unfixed)low

Notes

[wheezy] - samba <not-affected> (Doesn't provide AD functionality)
[squeeze] - samba <not-affected> (Doesn't provide AD functionality)

Search for package or bug name: Reporting problems