CVE-2009-2948

mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the path to the credentials file and using the --verbose or -v option.

• CWE-732

• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlMailing List, Third Party Advisory
• http://news.samba.org/releases/3.0.37/Broken Link, Vendor Advisory
• http://news.samba.org/releases/3.2.15/Broken Link, Vendor Advisory
• http://news.samba.org/releases/3.3.8/Broken Link, Vendor Advisory
• http://news.samba.org/releases/3.4.2/Broken Link, Vendor Advisory
• http://osvdb.org/58520Broken Link
• http://secunia.com/advisories/36893Not Applicable, Vendor Advisory
• http://secunia.com/advisories/36918Not Applicable, Vendor Advisory
• http://secunia.com/advisories/36937Not Applicable, Vendor Advisory
• http://secunia.com/advisories/36953Not Applicable, Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439Patch, Third Party Advisory
• http://www.samba.org/samba/security/CVE-2009-2948.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/36572Patch, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022975Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-839-1Third Party Advisory
• http://www.vupen.com/english/advisories/2009/2810Permissions Required, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53574Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434Broken Link, Third Party Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087Broken Link, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.htmlPatch, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.htmlPatch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlMailing List, Third Party Advisory
• http://news.samba.org/releases/3.0.37/Broken Link, Vendor Advisory
• http://news.samba.org/releases/3.2.15/Broken Link, Vendor Advisory
• http://news.samba.org/releases/3.3.8/Broken Link, Vendor Advisory
• http://news.samba.org/releases/3.4.2/Broken Link, Vendor Advisory
• http://osvdb.org/58520Broken Link
• http://secunia.com/advisories/36893Not Applicable, Vendor Advisory
• http://secunia.com/advisories/36918Not Applicable, Vendor Advisory
• http://secunia.com/advisories/36937Not Applicable, Vendor Advisory
• http://secunia.com/advisories/36953Not Applicable, Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561439Patch, Third Party Advisory
• http://www.samba.org/samba/security/CVE-2009-2948.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/36572Patch, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022975Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-839-1Third Party Advisory
• http://www.vupen.com/english/advisories/2009/2810Permissions Required, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53574Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10434Broken Link, Third Party Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7087Broken Link, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00095.htmlPatch, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00098.htmlPatch, Third Party Advisory

Published

Oct 7, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2942The mysql-ocaml bindings 1.0.4 for MySQL do not properly sup…
• CVE-2009-2943The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for P…
• CVE-2009-2944Incomplete blacklist vulnerability in the teximg plugin in i…
• CVE-2009-2945weblogin/login.fcgi (aka the WebLogin login script) in Stanf…
• CVE-2009-2946Eval injection vulnerability in scripts/uscan.pl before Rev …
• CVE-2009-2947Cross-site scripting (XSS) vulnerability in Xapian Omega bef…
• CVE-2009-2949Integer overflow in the XPMReader::ReadXPM function in filte…
• CVE-2009-2950Heap-based buffer overflow in the GIFLZWDecompressor::GIFLZW…
• CVE-2009-2951Phenotype CMS before 2.9 does not use a random salt value fo…
• CVE-2009-2952Unspecified vulnerability in the pollwakeup function in Sun …
• CVE-2009-2953Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remo…
• CVE-2009-2954Microsoft Internet Explorer 6.0.2900.2180 and earlier allows…