Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

A local attacker can read the Samba SSL/TLS secret key, in order
to decrypt https/ldaps exchanges.

– Impacted products: openSUSE, Samba, Slackware
– Severity: 2/4
– Creation date: 12/11/2013

DESCRIPTION OF THE VULNERABILITY

The Samba product can use SSL/TLS for its https web site, or for
ldaps.

The /var/lib/samba/private/tls/key.pem file contains the secret
key for SSL/TLS. However, permissions on this file allows all
local users to read it.

A local attacker can therefore read the Samba SSL/TLS secret key,
in order to decrypt https/ldaps exchanges.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Samba-reading-key-pem-13735