CVE-2013-4475 Security feature bypass in n/a
Remote attackers can bypass file restrictions and access protected data by exploiting ACL differences in alternate data streams when specific VFS modules are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4475?
CVE-2013-4475 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 13 Nov 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).
Weakness: CWE-264
Which versions are affected by CVE-2013-4475?
It affects 3 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Samba Samba.
How do I fix CVE-2013-4475?
Upgrade to a fixed version.
Is CVE-2013-4475 being exploited?
There is no known exploitation of CVE-2013-4475 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2013-4475, ECHO-b78d-d090-f185, GHSA-rhf5-jmh4-q5rv, MGASA-2013-0348, UBUNTU-CVE-2013-4475.