A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | May 8, 2020 | Nov 6, 2019 |
| Amazon Linux Ami 2 | — | Upgrade samba-winbindUpgrade samba-winbind-clientsUpgrade samba-common-libsUpgrade libsmbclientUpgrade samba-winbind-modulesUpgrade samba-pythonUpgrade samba-winbind-krb5-locatorUpgrade ctdb-testsUpgrade samba-dcUpgrade sambaUpgrade samba-python-testUpgrade libwbclient-develUpgrade samba-client-libsUpgrade samba-dc-libsUpgrade samba-common-toolsUpgrade samba-clientUpgrade samba-commonUpgrade libsmbclient-develUpgrade samba-krb5-printingUpgrade ctdbUpgrade samba-test-libsUpgrade samba-debuginfoUpgrade samba-testUpgrade samba-libsUpgrade samba-vfs-glusterfsUpgrade samba-pidlUpgrade samba-develUpgrade libwbclient | Jul 21, 2020 | Nov 6, 2019 |
| Amazon_linux | — | Upgrade samba | Sep 1, 2020 | Oct 30, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 6, 2019 |
| Centos_linux | — | Upgrade python3-samba-debuginfoUpgrade samba-test-libsUpgrade samba-test-debuginfoUpgrade openchange-debuginfoUpgrade libwbclientUpgrade samba-vfs-glusterfsUpgrade samba-krb5-printingUpgrade samba-libs-debuginfoUpgrade python3-sambaUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-libsUpgrade samba-common-tools-debuginfoUpgrade samba-testUpgrade samba-commonUpgrade openchange-client-debuginfoUpgrade samba-pidlUpgrade samba-common-libs-debuginfoUpgrade samba-clientUpgrade samba-common-toolsUpgrade samba-test-libs-debuginfoUpgrade samba-winbind-krb5-locatorUpgrade libsmbclient-debuginfoUpgrade libwbclient-debuginfoUpgrade samba-debugsourceUpgrade samba-client-libsUpgrade samba-client-debuginfoUpgrade libsmbclientUpgrade libsmbclient-develUpgrade samba-common-libsUpgrade ctdbUpgrade samba-winbind-clients-debuginfoUpgrade openchangeUpgrade samba-winbind-debuginfoUpgrade samba-winbind-clientsUpgrade ctdb-tests-debuginfoUpgrade samba-pythonUpgrade samba-vfs-glusterfs-debuginfoUpgrade samba-winbind-modules-debuginfoUpgrade libwbclient-develUpgrade samba-krb5-printing-debuginfoUpgrade samba-dcUpgrade openchange-debugsourceUpgrade samba-client-libs-debuginfoUpgrade samba-develUpgrade sambaUpgrade samba-dc-libsUpgrade ctdb-debuginfoUpgrade samba-debuginfoUpgrade samba-winbind-modulesUpgrade samba-python-testUpgrade ctdb-testsUpgrade samba-winbindUpgrade python3-samba-test | Apr 1, 2020 | Nov 6, 2019 |
| Debian | — | Upgrade samba | May 31, 2021 | Nov 6, 2019 |
| Freebsd | — | Upgrade samba48Upgrade samba411Upgrade samba410 | Nov 1, 2019 | Oct 29, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade samba-common-libsUpgrade samba-winbindUpgrade samba-commonUpgrade samba-winbind-modulesUpgrade samba-libsUpgrade samba-pythonUpgrade libsmbclientUpgrade libwbclientUpgrade samba-clientUpgrade samba-client-libsUpgrade samba-common-toolsUpgrade sambaUpgrade samba-winbind-clients | Sep 28, 2020 | Nov 6, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libwbclientUpgrade samba-commonUpgrade samba-winbindUpgrade samba-winbind-clientsUpgrade samba-pythonUpgrade libsmbclientUpgrade samba-libsUpgrade samba-client-libsUpgrade sambaUpgrade samba-common-toolsUpgrade samba-winbind-modulesUpgrade samba-clientUpgrade samba-common-libs | Dec 11, 2019 | Nov 6, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ctdbUpgrade python2-sambaUpgrade samba-libsUpgrade samba-dc-libsUpgrade sambaUpgrade samba-common-libsUpgrade samba-commonUpgrade samba-test-libsUpgrade python3-samba-testUpgrade samba-krb5-printingUpgrade samba-winbindUpgrade samba-pidlUpgrade samba-testUpgrade python2-samba-testUpgrade samba-client-libsUpgrade ctdb-testsUpgrade samba-common-toolsUpgrade samba-clientUpgrade python3-sambaUpgrade samba-winbind-krb5-locatorUpgrade libsmbclientUpgrade samba-winbind-modulesUpgrade samba-winbind-clientsUpgrade libwbclient | Jan 3, 2020 | Nov 6, 2019 |
| Oracle Solaris | — | Upgrade library/samba/libsmbclient to version 4.11.6-11.4.21.0.1.69.0 on Solaris 11.4Upgrade service/network/samba to version 4.11.6-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 6, 2019 |
| Oracle_linux | — | Upgrade samba-test-libsUpgrade libwbclientUpgrade samba-python-testUpgrade samba-pidlUpgrade python3-sambaUpgrade samba-clientUpgrade samba-krb5-printingUpgrade samba-testUpgrade samba-dcUpgrade samba-client-libsUpgrade ctdbUpgrade samba-develUpgrade samba-common-libsUpgrade samba-vfs-glusterfsUpgrade samba-commonUpgrade samba-winbind-modulesUpgrade sambaUpgrade samba-winbind-krb5-locatorUpgrade samba-winbindUpgrade samba-pythonUpgrade openchangeUpgrade libwbclient-develUpgrade samba-common-toolsUpgrade python3-samba-testUpgrade ctdb-testsUpgrade samba-winbind-clientsUpgrade samba-libsUpgrade samba-dc-libsUpgrade libsmbclientUpgrade libsmbclient-devel | Oct 5, 2022 | Oct 29, 2019 |
| Redhat_linux | — | Upgrade samba-pythonUpgrade ctdb-testsUpgrade python3-sambaUpgrade libwbclient-develUpgrade samba-winbind-clients-debuginfoUpgrade samba-krb5-printing-debuginfoUpgrade sambaUpgrade libsmbclientUpgrade samba-winbindUpgrade samba-pidlUpgrade openchangeUpgrade libsmbclient-debuginfoUpgrade libwbclientUpgrade samba-client-libsUpgrade openchange-client-debuginfoUpgrade samba-common-libs-debuginfoUpgrade openchange-debuginfoUpgrade ctdb-debuginfoUpgrade openchange-debugsourceUpgrade samba-client-libs-debuginfoUpgrade samba-winbind-modulesUpgrade samba-winbind-clientsUpgrade samba-develUpgrade samba-debugsourceUpgrade samba-dcUpgrade samba-test-libs-debuginfoUpgrade samba-dc-libsUpgrade samba-common-toolsUpgrade samba-test-libsUpgrade samba-common-libsUpgrade samba-winbind-debuginfoUpgrade samba-python-testUpgrade samba-client-debuginfoUpgrade samba-winbind-modules-debuginfoUpgrade python3-samba-debuginfoNo solution existsUpgrade samba-libsUpgrade samba-winbind-krb5-locatorUpgrade ctdbUpgrade samba-vfs-glusterfsUpgrade samba-clientUpgrade libsmbclient-develUpgrade samba-debuginfoUpgrade samba-test-debuginfoUpgrade python3-samba-testUpgrade samba-winbind-krb5-locator-debuginfoUpgrade ctdb-tests-debuginfoUpgrade samba-commonUpgrade samba-libs-debuginfoUpgrade samba-vfs-glusterfs-debuginfoUpgrade samba-krb5-printingUpgrade samba-common-tools-debuginfoUpgrade samba-testUpgrade libwbclient-debuginfo | Apr 1, 2020 | Nov 6, 2019 |
| Samba | — | Upgrade to Samba 4.11.2 or later.Upgrade to Samba 4.9.15 or later.Upgrade to Samba 4.10.10 or later. | Nov 6, 2019 | Nov 6, 2019 |
| Suse | — | Upgrade libdcerpc-binding0-32bitUpgrade libndr-nbt0-32bitUpgrade libsamdb0-32bitUpgrade libsmbconf0-32bitUpgrade samba-client-32bitUpgrade libdcerpc0Upgrade samba-testUpgrade libsamdb-develUpgrade libsamba-hostconfig-develUpgrade libgensec0Upgrade libsamba-passdb0Upgrade libsamba-errors-develUpgrade ldb-toolsUpgrade libndr1Upgrade samba-cephUpgrade libsamba-policy0-python3Upgrade samba-libs-python-32bitUpgrade libndr-standard-develUpgrade libsamba-policy0-32bitUpgrade ctdb-testsUpgrade samba-kdcUpgrade libsamba-util0-32bitUpgrade libldb1Upgrade libsmbconf0Upgrade libndr1-32bitUpgrade libgensec0-32bitUpgrade libsamba-policy0Upgrade libsamba-policy-python-develUpgrade libndr0Upgrade libsamba-passdb-develUpgrade samba-libsUpgrade samba-dsdb-modulesUpgrade libndr-standard0-32bitUpgrade samba-libs-pythonUpgrade samba-pidlUpgrade samba-32bitUpgrade libtalloc2Upgrade samba-libs-python3-32bitUpgrade libdcerpc-samr0Upgrade ctdbUpgrade libndr-develUpgrade libsamba-credentials0Upgrade python-ldb-develUpgrade libtevent0Upgrade libtevent0-32bitUpgrade libtevent-util-develUpgrade libsmbclient-raw0Upgrade libsmbldap-develUpgrade libdcerpc-samr-develUpgrade libsmbclient0Upgrade samba-pythonUpgrade libsamdb0Upgrade libsamba-util0Upgrade libldb1-32bitUpgrade libsmbclient0-32bitUpgrade sambaUpgrade libsamba-policy0-python3-32bitUpgrade libdcerpc-develUpgrade samba-ad-dc-32bitUpgrade samba-kdc-32bitUpgrade samba-libs-python3Upgrade samba-python3Upgrade libsamba-hostconfig0-32bitUpgrade libsamba-policy-python3-develUpgrade libtdb1Upgrade samba-docUpgrade libtevent-util0Upgrade libsmbclient-raw0-32bitUpgrade libregistry0Upgrade libsmbconf-develUpgrade libwbclient-develUpgrade libsamba-errors0Upgrade libndr-nbt0Upgrade libndr-krb5pac0-32bitUpgrade samba-winbind-32bitUpgrade libwbclient0Upgrade libnetapi-develUpgrade libdcerpc-binding0Upgrade libndr-nbt-develUpgrade libtdb1-32bitUpgrade samba-clientUpgrade libnetapi0Upgrade libndr0-32bitUpgrade ctdb-pcp-pmdaUpgrade libsmbldap2-32bitUpgrade libtalloc2-32bitUpgrade libdcerpc-samr0-32bitUpgrade libsmbldap0Upgrade samba-winbindUpgrade samba-krb-printingUpgrade libsamba-errors0-32bitUpgrade libndr-krb5pac-develUpgrade samba-core-develUpgrade libdcerpc-atsvc0Upgrade libsmbldap0-32bitUpgrade libsamba-credentials-develUpgrade samba-libs-32bitUpgrade libtevent-util0-32bitUpgrade libsamba-passdb0-32bitUpgrade python-ldbUpgrade libnetapi0-32bitUpgrade ldapsmbUpgrade libndr-krb5pac0Upgrade libsmbclient-develUpgrade libsamba-credentials0-32bitUpgrade libsamba-hostconfig0Upgrade samba-ad-dcUpgrade libsamba-policy-develUpgrade libdcerpc0-32bitUpgrade libsmbldap2Upgrade libwbclient0-32bitUpgrade libsamba-util-develUpgrade libndr-standard0Upgrade libldb-devel | Oct 30, 2019 | Oct 29, 2019 |
| Ubuntu | — | Upgrade libsmbclientUpgrade samba (Ubuntu Pro)Upgrade libsmbclient (Ubuntu Pro)Upgrade samba | Oct 30, 2019 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub