CVE-2013-4475.html:

===========================================================
== Subject:     ACLs are not checked on opening an alternate
==		data stream on a file or directory.
==
== CVE ID#:     CVE-2013-4475
==
== Versions:    All versions of Samba later than 3.2.0
==
== Summary:     When opening an alternate data stream on a file
==		or directory, any Windows ACL present on that
==		underlying file or directory is not used to
==		control access to the alternate data stream.
==
===========================================================

===========
Description
===========

Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
file or directory ACL when opening an alternate data stream.

According to the SMB1 and SMB2+ protocols the ACL on an underlying
file or directory should control what access is allowed to alternate
data streams that are associated with the file or directory.

By default no version of Samba supports alternate data streams
on files or directories.

Samba can be configured to support alternate data streams by loading
either one of two virtual file system modues (VFS) vfs_streams_depot or
vfs_streams_xattr supplied with Samba, so this bug only affects Samba
servers configured this way.

To determine if your server is vulnerable, check for the strings
"streams_depot" or "streams_xattr" inside your smb.conf configuration
file.

==================
Patch Availability
==================

Patches addressing this issue have been posted to:

    http://www.samba.org/samba/security/

Samba versions 3.6.20, 4.0.11, and 4.1.1 have been released to
address this issue.

==========
Workaround
==========

Remove all uses of:

vfs objects = streams_depot

and:

vfs objects = streams_xattr

from the [global] section of your smb.conf file, and from
all share definitions in your smb.conf file.

=======
Credits
=======

This issue was discovered by Hemanth Thummala <hemanth.thummala@gmail.com>,
and the Samba Team would like to thank Hemanth for bringing this to
our attention.

Patches provided by Jeremy Allison of the Samba Team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================