CVE-2013-4476
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses...
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
Exploit likelihood
What each source reports
NVD Score used
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
- Record
CVE-2013-4476- CVSS 2.0
- 1.2 Low
AV:L/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
- Record
CVE-2013-4476- Updated
- 2026-11-02
EUVDEUVD-2013-4344 No score
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
- Record
EUVD-2013-4344- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2wh-x73f-g4qw No score
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses...
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
- Record
GHSA-r2wh-x73f-g4qw- Updated
- 2026-11-02
OSV No score
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
- Record
CVE-2013-4476- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4476 No score
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.
- Record
DEBIAN-CVE-2013-4476- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10069-1 No score
ctdb-4.5.0-1.1 on GA media
These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10069-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4476 is a low vulnerability (CVSS 1.2) in Samba, published November 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 38th percentile. Fixed in samba 2:4.0.11+dfsg-1.
References
samba.org/samba/history/samba-4.1.1.html
security.gentoo.org/glsa/glsa-201502-15.xml
lists.opensuse.org/opensuse-updates/2013-11/msg00083.html
Show 59 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4476
github.com/advisories/GHSA-r2wh-x73f-g4qw
security-tracker.debian.org/tracker/CVE-2013-4476
suse.com/security/cve/CVE-2009-1886