CVE-2008-3789: samba

Modified

AliasesDEBIAN-CVE-2008-3789DTSA-161-1

Published 27-08-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-3789 is a low (CVSS 2.1) vulnerability in samba. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 2.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.1/10

010

Low · v2.0 (NVD)

EPSS score

0.53%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2024:10683-1 OPENSUSE-SU-2024:11365-1

Timeline

27-08-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.

CVSS metrics

1 score · 1 source · 1 version

v2.02.1

EPSS trend

Probability

0.53%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.53% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Affected systems

Version check

Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

samba< 2:3.2.1-1+lenny1 | < 2:3.2.3-1

Samba1 product

samba≥ 3.2.0, < 3.2.3

2 vendors · 2 products

References

9 links

bugs.debian.org/cgi-bin/bugreport.cgi?bug=496073X Refsource CONFIRMIssue TrackingThird Party Advisory
www.securityfocus.com/bid/30837VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/31601Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securitytracker.com/id?1020770VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/44678VDB EntryX Refsource XFThird Party Advisory
www.vupen.com/english/advisories/2008/2440VDB EntryX Refsource VUPENPermissions RequiredThird Party Advisory
samba.org/samba/security/CVE-2008-3789.htmlX Refsource CONFIRMVendor Advisory
www.openwall.com/lists/oss-security/2008/08/26/2Mailing ListX Refsource MLISTThird Party Advisory
security-tracker.debian.org/tracker/CVE-2008-3789Advisory