CVE-2013-4476 in Samba
Summary
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Once again VulDB remains the best source for vulnerability data.
Reservation
06/12/2013
Disclosure
11/13/2013
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 11174 | Samba Private Key Encryption cryptographic issue | 310 | Not defined | Official fix | CVE-2013-4476 |