CVE-2015-7560

6.5 MEDIUM

Published: March 13, 2016 Modified: May 06, 2026

Description

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://www.debian.org/security/2016/dsa-3514

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/84267

Source: secalert@redhat.com

Third Party Advisory VDB Entry

http://www.securitytracker.com/id/1035220

Source: secalert@redhat.com

Third Party Advisory VDB Entry

http://www.ubuntu.com/usn/USN-2922-1

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.samba.org/show_bug.cgi?id=11648

Source: secalert@redhat.com

Issue Tracking Vendor Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842

Source: secalert@redhat.com

Third Party Advisory

https://www.samba.org/samba/security/CVE-2015-7560.html

Source: secalert@redhat.com

Vendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178730.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178764.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180000.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00063.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00064.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00065.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00081.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00090.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00092.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

http://www.debian.org/security/2016/dsa-3514

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/84267

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory VDB Entry

http://www.securitytracker.com/id/1035220

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory VDB Entry

http://www.ubuntu.com/usn/USN-2922-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.samba.org/show_bug.cgi?id=11648

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking Vendor Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121842

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.samba.org/samba/security/CVE-2015-7560.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

38 reference(s) from NVD

Quick Stats

CVSS v3 Score

6.5 / 10.0

EPSS (Exploit Probability)

4.0%

88th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-284

Affected Vendors

samba canonical debian

Related CVEs