Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:3.5.10~dfsg-1 | — |
| Debian 13 | samba | 2:3.5.10~dfsg-1 | — |
| Debian 12 | samba | 2:3.5.10~dfsg-1 | — |
| Debian 6.0 | samba | 2:3.5.6~dfsg-3squeeze5 | DSA-2290-1 |
| Debian 5.0 | samba | 2:3.2.5-4lenny15 | DSA-2290-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | cifs-utils | 4.8.1-2.el6_1.2 | RHSA-2011:1221 |
| RHEL 6 | samba +11 | 3.5.6-86.el6_1.4 | RHSA-2011:1221 |
| RHEL 5 | samba +5 | 3.0.33-3.29.el5_7.4 | RHSA-2011:1219 |
| RHEL 5 | samba3x +7 | 3.5.4-0.83.el5_7.2 | RHSA-2011:1220 |
| RHEL 4 | samba +3 | 3.0.33-0.34.el4 | RHSA-2011:1219 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.5.0-1.1 | openSUSE-SU-2024:10069-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- SWAT Samba Web Administration Tool - Cross-Site Request Forgery EDB-17577 · webapps · Jul 27, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2011:1221 Red Hat Security Advisory: samba and cifs-utils security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1219 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1220 Red Hat Security Advisory: samba3x security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2290-1 samba - cross-side scripting Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10069-1 ctdb-4.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- MDVSA-2011:121 vendor-advisory
- 74071 vdb-entry
- HPSBNS02701 vendor-advisory
- SSRT100664 vendor-advisory
- 1025852 vdb-entry
- https://bugzilla.samba.org/show_bug.cgi?id=8290
- DSA-2290 vendor-advisory
- http://www.samba.org/samba/security/CVE-2011-2522
- 45393 third-party-advisory
- 45496 third-party-advisory
- 45488 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=721348
- http://samba.org/samba/history/samba-3.5.10.html
- 17577 exploit
- 8317 third-party-advisory
- JVN#29529126 third-party-advisory
- USN-1182-1 vendor-advisory
- 48899 vdb-entry
- samba-swat-csrf(68843) vdb-entry