client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.
| Software | From | Fixed in |
|---|---|---|
| samba / samba | - | 3.4.5.x |
| samba / samba | 1.9.17 | 1.9.17.x |
| samba / samba | 1.9.17-p1 | 1.9.17-p1.x |
| samba / samba | 1.9.17-p2 | 1.9.17-p2.x |
| samba / samba | 1.9.17-p3 | 1.9.17-p3.x |
| samba / samba | 1.9.17-p4 | 1.9.17-p4.x |
| samba / samba | 1.9.17-p5 | 1.9.17-p5.x |
| samba / samba | 1.9.18 | 1.9.18.x |
| samba / samba | 1.9.18-p1 | 1.9.18-p1.x |
| samba / samba | 1.9.18-p10 | 1.9.18-p10.x |
| samba / samba | 1.9.18-p2 | 1.9.18-p2.x |
| samba / samba | 1.9.18-p3 | 1.9.18-p3.x |
| samba / samba | 1.9.18-p4 | 1.9.18-p4.x |
| samba / samba | 1.9.18-p5 | 1.9.18-p5.x |
| samba / samba | 1.9.18-p6 | 1.9.18-p6.x |
| samba / samba | 1.9.18-p7 | 1.9.18-p7.x |
| samba / samba | 1.9.18-p8 | 1.9.18-p8.x |
| samba / samba | 2.2.0 | 2.2.0.x |
| samba / samba | 2.2.0a | 2.2.0a.x |
| samba / samba | 2.2.1 | 2.2.1.x |
| samba / samba | 2.2.10 | 2.2.10.x |
| samba / samba | 2.2.11 | 2.2.11.x |
| samba / samba | 2.2.12 | 2.2.12.x |
| samba / samba | 2.2.1a | 2.2.1a.x |
| samba / samba | 2.2.2 | 2.2.2.x |
| samba / samba | 2.2.3 | 2.2.3.x |
| samba / samba | 2.2.3a | 2.2.3a.x |
| samba / samba | 2.2.4 | 2.2.4.x |
| samba / samba | 2.2.5 | 2.2.5.x |
| samba / samba | 2.2.6 | 2.2.6.x |
| samba / samba | 2.2.7 | 2.2.7.x |
| samba / samba | 2.2.7a | 2.2.7a.x |
| samba / samba | 2.2.8 | 2.2.8.x |
| samba / samba | 2.2.8a | 2.2.8a.x |
| samba / samba | 2.2.9 | 2.2.9.x |
| samba / samba | 2.2a | 2.2a.x |
| samba / samba | 3.0.0 | 3.0.0.x |
| samba / samba | 3.0.1 | 3.0.1.x |
| samba / samba | 3.0.10 | 3.0.10.x |
| samba / samba | 3.0.11 | 3.0.11.x |
| samba / samba | 3.0.12 | 3.0.12.x |
| samba / samba | 3.0.13 | 3.0.13.x |
| samba / samba | 3.0.14 | 3.0.14.x |
| samba / samba | 3.0.14a | 3.0.14a.x |
| samba / samba | 3.0.2 | 3.0.2.x |
| samba / samba | 3.0.20 | 3.0.20.x |
| samba / samba | 3.0.20a | 3.0.20a.x |
| samba / samba | 3.0.20b | 3.0.20b.x |
| samba / samba | 3.0.21 | 3.0.21.x |
| samba / samba | 3.0.21a | 3.0.21a.x |
| samba / samba | 3.0.21b | 3.0.21b.x |
| samba / samba | 3.0.21c | 3.0.21c.x |
| samba / samba | 3.0.22 | 3.0.22.x |
| samba / samba | 3.0.23 | 3.0.23.x |
| samba / samba | 3.0.23a | 3.0.23a.x |
| samba / samba | 3.0.23b | 3.0.23b.x |
| samba / samba | 3.0.23c | 3.0.23c.x |
| samba / samba | 3.0.23d | 3.0.23d.x |
| samba / samba | 3.0.24 | 3.0.24.x |
| samba / samba | 3.0.25 | 3.0.25.x |
| samba / samba | 3.0.25-pre1 | 3.0.25-pre1.x |
| samba / samba | 3.0.25-pre2 | 3.0.25-pre2.x |
| samba / samba | 3.0.25-rc1 | 3.0.25-rc1.x |
| samba / samba | 3.0.25-rc2 | 3.0.25-rc2.x |
| samba / samba | 3.0.25-rc3 | 3.0.25-rc3.x |
| samba / samba | 3.0.25a | 3.0.25a.x |
| samba / samba | 3.0.25b | 3.0.25b.x |
| samba / samba | 3.0.25c | 3.0.25c.x |
| samba / samba | 3.0.26 | 3.0.26.x |
| samba / samba | 3.0.26a | 3.0.26a.x |
| samba / samba | 3.0.27 | 3.0.27.x |
| samba / samba | 3.0.27a | 3.0.27a.x |
| samba / samba | 3.0.28 | 3.0.28.x |
| samba / samba | 3.0.28a | 3.0.28a.x |
| samba / samba | 3.0.29 | 3.0.29.x |
| samba / samba | 3.0.2a | 3.0.2a.x |
| samba / samba | 3.0.3 | 3.0.3.x |
| samba / samba | 3.0.30 | 3.0.30.x |
| samba / samba | 3.0.31 | 3.0.31.x |
| samba / samba | 3.0.32 | 3.0.32.x |
| samba / samba | 3.0.33 | 3.0.33.x |
| samba / samba | 3.0.34 | 3.0.34.x |
| samba / samba | 3.0.35 | 3.0.35.x |
| samba / samba | 3.0.36 | 3.0.36.x |
| samba / samba | 3.0.37 | 3.0.37.x |
| samba / samba | 3.0.4 | 3.0.4.x |
| samba / samba | 3.0.4-rc1 | 3.0.4-rc1.x |
| samba / samba | 3.0.5 | 3.0.5.x |
| samba / samba | 3.0.6 | 3.0.6.x |
| samba / samba | 3.0.8 | 3.0.8.x |
| samba / samba | 3.0.9 | 3.0.9.x |
| samba / samba | 3.2.0 | 3.2.0.x |
| samba / samba | 3.2.1 | 3.2.1.x |
| samba / samba | 3.2.10 | 3.2.10.x |
| samba / samba | 3.2.11 | 3.2.11.x |
| samba / samba | 3.2.12 | 3.2.12.x |
| samba / samba | 3.2.13 | 3.2.13.x |
| samba / samba | 3.2.14 | 3.2.14.x |
| samba / samba | 3.2.15 | 3.2.15.x |
| samba / samba | 3.2.2 | 3.2.2.x |
| samba / samba | 3.2.3 | 3.2.3.x |
| samba / samba | 3.2.4 | 3.2.4.x |
| samba / samba | 3.2.5 | 3.2.5.x |
| samba / samba | 3.2.6 | 3.2.6.x |
| samba / samba | 3.2.7 | 3.2.7.x |
| samba / samba | 3.2.8 | 3.2.8.x |
| samba / samba | 3.2.9 | 3.2.9.x |
| samba / samba | 3.3.0 | 3.3.0.x |
| samba / samba | 3.3.1 | 3.3.1.x |
| samba / samba | 3.3.10 | 3.3.10.x |
| samba / samba | 3.3.2 | 3.3.2.x |
| samba / samba | 3.3.3 | 3.3.3.x |
| samba / samba | 3.3.4 | 3.3.4.x |
| samba / samba | 3.3.5 | 3.3.5.x |
| samba / samba | 3.3.6 | 3.3.6.x |
| samba / samba | 3.3.7 | 3.3.7.x |
| samba / samba | 3.3.8 | 3.3.8.x |
| samba / samba | 3.3.9 | 3.3.9.x |
| samba / samba | 3.4.0 | 3.4.0.x |
| samba / samba | 3.4.1 | 3.4.1.x |
| samba / samba | 3.4.2 | 3.4.2.x |
| samba / samba | 3.4.3 | 3.4.3.x |
| samba / samba | 3.4.4 | 3.4.4.x |