CVE-2015-7560 : The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.

Published 2016-03-13 22:59:00

Updated 2025-04-12 10:46:41

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-7560

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Samba » Samba
Versions from including (>=) 4.3.0 and before (<) 4.3.6
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Matching versions
Samba » Samba
Versions from including (>=) 3.2.0 and before (<) 4.1.23
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Matching versions
Samba » Samba
Versions from including (>=) 4.2.0 and before (<) 4.2.9
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Matching versions
Samba » Samba » Version: 4.4.0 Update RC3
cpe:2.3:a:samba:samba:4.4.0:rc3:*:*:*:*:*:*
Matching versions
Samba » Samba » Version: 4.4.0 Update RC2
cpe:2.3:a:samba:samba:4.4.0:rc2:*:*:*:*:*:*
Matching versions
Samba » Samba » Version: 4.4.0 Update RC1
cpe:2.3:a:samba:samba:4.4.0:rc1:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-7560

EPSS FAQ

4.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 88 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-7560

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2015-7560

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-7560

http://www.debian.org/security/2016/dsa-3514

Debian -- Security Information -- DSA-3514-1 samba
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

[security-announce] openSUSE-SU-2016:1064-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.samba.org/samba/security/CVE-2015-7560.html

Samba - Security Announcement Archive
Vendor Advisory
http://www.securitytracker.com/id/1035220

Samba SMB1 UNIX Extensions Symlink Flaw Lets Remote Authenticated Users Overwrite Access Control Lists - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/84267

Samba CVE-2015-7560 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html

[security-announce] SUSE-SU-2016:0814-1: important: Security update for
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html

[security-announce] openSUSE-SU-2016:0813-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

[security-announce] openSUSE-SU-2016:1106-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html

[SECURITY] Fedora 22 Update: samba-4.2.9-0.fc22
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html

[security-announce] SUSE-SU-2016:0905-1: important: Security update for
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html

[security-announce] SUSE-SU-2016:0837-1: important: Security update for
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html

[security-announce] openSUSE-SU-2016:0877-1: important: Security update
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html

[security-announce] SUSE-SU-2016:0816-1: important: Security update for
Mailing List;Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=11648

Access Denied
Issue Tracking;Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html

[SECURITY] Fedora 24 Update: samba-4.4.0-0.7.rc4.fc24
Mailing List;Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html

[SECURITY] Fedora 23 Update: samba-4.3.6-0.fc23
Mailing List;Third Party Advisory
http://www.ubuntu.com/usn/USN-2922-1

USN-2922-1: Samba vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842

HPSBUX03596 rev.2 - HPE HP-UX running CIFS Server (Samba), Remote Access Restriction Bypass, Unauthorized Access
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

[security-announce] openSUSE-SU-2016:1107-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2015-7560

Products affected by CVE-2015-7560

Exploit prediction scoring system (EPSS) score for CVE-2015-7560

CVSS scores for CVE-2015-7560

CWE ids for CVE-2015-7560

References for CVE-2015-7560