A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | Aug 22, 2024 | Jan 12, 2023 |
| Amazon_linux_2023 | — | Upgrade samba-ldb-ldap-modulesUpgrade samba-common-libs-debuginfoUpgrade samba-winbind-clients-debuginfoUpgrade samba-ldb-ldap-modules-debuginfoUpgrade samba-libsUpgrade samba-usersharesUpgrade python3-sambaUpgrade libwbclientUpgrade samba-krb5-printingUpgrade samba-winbind-modules-debuginfoUpgrade samba-vfs-iouringUpgrade samba-testUpgrade samba-debuginfoUpgrade samba-common-tools-debuginfoUpgrade libsmbclient-debuginfoUpgrade libsmbclient-develUpgrade samba-client-libsUpgrade samba-test-debuginfoUpgrade libnetapi-debuginfoUpgrade samba-dcerpc-debuginfoUpgrade samba-libs-debuginfoUpgrade libwbclient-debuginfoUpgrade python3-samba-develUpgrade samba-krb5-printing-debuginfoUpgrade samba-pidlUpgrade libnetapiUpgrade samba-dc-libs-debuginfoUpgrade samba-client-libs-debuginfoUpgrade samba-winbindUpgrade samba-commonUpgrade samba-winbind-modulesUpgrade samba-dc-libsUpgrade samba-vfs-iouring-debuginfoUpgrade samba-winbind-krb5-locator-debuginfoUpgrade libsmbclientUpgrade python3-samba-testUpgrade samba-winbind-clientsUpgrade samba-winbind-krb5-locatorUpgrade samba-develUpgrade samba-test-libsUpgrade samba-clientUpgrade libnetapi-develUpgrade samba-common-toolsUpgrade samba-debugsourceUpgrade libwbclient-develUpgrade samba-client-debuginfoUpgrade sambaUpgrade samba-common-libsUpgrade samba-winbind-debuginfoUpgrade python3-samba-debuginfoUpgrade samba-test-libs-debuginfoUpgrade samba-dcerpc | Feb 17, 2025 | Oct 25, 2022 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Jan 12, 2023 |
| Samba | — | Upgrade to Samba 4.17.2 or later. | Jan 12, 2023 | Jan 12, 2023 |
| Suse | — | Upgrade samba-libs-32bitUpgrade samba-libs-python3Upgrade samba-client-libsUpgrade samba-client-libs-32bitUpgrade samba-ldb-ldapUpgrade samba-cephUpgrade samba-python3Upgrade samba-gpupdateUpgrade samba-winbind-libsUpgrade samba-libsUpgrade sambaUpgrade libsamba-policy0-python3Upgrade samba-winbindUpgrade samba-develUpgrade samba-winbind-libs-32bitUpgrade libsamba-policy-develUpgrade samba-clientUpgrade libsamba-policy-python3-devel | Jun 13, 2023 | Jan 12, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub