CVE-2009-1888: Canonical Ubuntu Linux

Medium severity, CVSS 5.8. EPSS: 4.6% chance of exploitation in the next 30 days.

The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only
• Debian Debian Linux: version 4.0 only; version 5.0 only
• Samba Samba: from 3.0.31, up to and including 3.0.35; from 3.2.0, before 3.2.13 (fixed in 3.2.13); from 3.3.0, before 3.3.6 (fixed in 3.3.6)

Published 2009-06-25. Last modified 2026-06-16.