Unscored severity · published May 28, 2014
CVE-2014-0178
Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the…
–
CVSS
4.5%
EPSS
No
On KEV
Description
Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Samba · Samba
3.6.6 before 3.6.25; 4.0.0 before 4.0.18; 4.1.0 before 4.1.8; 4.1.0; 4.1.1; 4.1.2; +23 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0178
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0178
Third Party Advisory
http://advisories.mageia.org/MGASA-2014-0279.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html
Third Party Advisory
http://secunia.com/advisories/59378
Third Party Advisory
http://secunia.com/advisories/59407
Third Party Advisory
http://secunia.com/advisories/59579
More from Samba
9.8
CVE-2017-7494
Samba Remote Code Execution Vulnerability
5.5
CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2023-3961
Samba: smbd allows client access to unix domain sockets on the file system as root
9.8
CVE-2022-45141
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable…