Description
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:3.6.6-5 | — |
| Debian 13 | samba | 2:3.6.6-5 | — |
| Debian 12 | samba | 2:3.6.6-5 | — |
| Debian 6.0 | samba | 2:3.5.6~dfsg-3squeeze9 | DSA-2617-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | samba +11 | 3.6.9-164.el6 | RHSA-2013:1542 |
| RHEL 5 | samba +5 | 3.0.33-3.40.el5_10 | RHSA-2014:0305 |
| RHEL 5 | samba3x +7 | 3.6.6-0.136.el5 | RHSA-2013:1310 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.5.0-1.1 | openSUSE-SU-2024:10069-1 |
Advisories 5
- RHSA-2013:1542 Red Hat Security Advisory: samba security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1310 Red Hat Security Advisory: samba3x security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0305 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2617-1 samba - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10069-1 ctdb-4.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.samba.org/samba/security/CVE-2013-0213
- SUSE-SU-2013:0326 vendor-advisory
- openSUSE-SU-2013:0281 vendor-advisory
- 57631 vdb-entry
- openSUSE-SU-2013:0277 vendor-advisory
- SUSE-SU-2013:0519 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993
- RHSA-2014:0305 vendor-advisory
- USN-2922-1 vendor-advisory
- DSA-2617 vendor-advisory
- RHSA-2013:1310 vendor-advisory
- RHSA-2013:1542 vendor-advisory