CVE-2013-4475

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).

Metrics

CVSS 2.0 4.0/10AV:N/AC:H/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 13, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-44761.2Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key,CVE-2013-44773.3The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that rolCVE-2013-44786.8Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filenamCVE-2013-44796.8lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell CVE-2013-44807.5Red Hat Satellite 5.6 and earlier does not disable the web interface that is used to create the first user for a satellite, which allows remCVE-2013-44811.9Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which aCVE-2013-44826.2Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local userCVE-2013-44834.9The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local useCVE-2013-44845.0Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET requeCVE-2013-44854.0389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of servicCVE-2013-44869.8Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in loggingCVE-2013-44875.0Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote serve