PT-2010-2649 · Samba+1 · Samba+1

Jeremy Allison + 1 · Published 2010-03-09 · Updated 2024-06-15 · CVE-2010-0926

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samba versions prior to 3.3.11 Samba versions 3.4.x prior to 3.4.6 Samba versions 3.5.x prior to 3.5.0rc3

Description The default configuration of smbd in Samba allows remote authenticated users to access arbitrary files by leveraging a directory traversal issue. This is achieved by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.

Recommendations For Samba versions prior to 3.3.11, update to version 3.3.11 or later. For Samba versions 3.4.x prior to 3.4.6, update to version 3.4.6 or later. For Samba versions 3.5.x prior to 3.5.0rc3, update to version 3.5.0rc3 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-0926

ECHO-BC72-4FE3-F30F

OPENSUSE-SU-2024:10069-1

RHSA-2012:0313

RHSA-2012_0313

Affected Products

Red Hat

Samba

References · 99

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/smb/samba_symlink_traversal.rb · Exploit
• 🔥 https://exploit-db.com/exploits/33598 · Exploit
• 🔥 https://exploit-db.com/exploits/33599 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0926 · Security Note
• http://samba.org/samba/news/symlink_attack.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-0926 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-0926 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0926 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html · Vendor Advisory
• http://marc.info/?l=samba-technical&m=126540539117328&w=2 · Note
• http://marc.info/?l=full-disclosure&m=126538598820903&w=2 · Note
• https://suse.com/security/cve/CVE-2015-5370 · Note
• http://gitweb.samba.org/?p=samba.git%3Ba=commit%3Bh=bd269443e311d96ef495a9db47d1b95eb83bb8f4 · Note