A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade samba | May 8, 2020 | Nov 6, 2019 |
| Amazon Linux Ami 2 | — | Upgrade samba-winbind-clientsUpgrade samba-dcUpgrade samba-winbind-krb5-locatorUpgrade samba-pythonUpgrade samba-winbindUpgrade libsmbclientUpgrade samba-common-libsUpgrade samba-client-libsUpgrade ctdb-testsUpgrade samba-python-testUpgrade libwbclient-develUpgrade samba-dc-libsUpgrade sambaUpgrade samba-winbind-modulesUpgrade samba-libsUpgrade libsmbclient-develUpgrade samba-clientUpgrade samba-develUpgrade samba-testUpgrade ctdbUpgrade samba-test-libsUpgrade samba-commonUpgrade samba-pidlUpgrade samba-vfs-glusterfsUpgrade samba-common-toolsUpgrade samba-debuginfoUpgrade samba-krb5-printingUpgrade libwbclient | Jul 21, 2020 | Nov 6, 2019 |
| Amazon_linux | — | Upgrade samba | Sep 1, 2020 | Oct 30, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 6, 2019 |
| Centos_linux | — | Upgrade openchange-client-debuginfoUpgrade libwbclientUpgrade samba-pidlUpgrade samba-libsUpgrade samba-libs-debuginfoUpgrade openchange-debuginfoUpgrade samba-common-libs-debuginfoUpgrade python3-sambaUpgrade samba-vfs-glusterfsUpgrade samba-commonUpgrade samba-krb5-printingUpgrade samba-common-tools-debuginfoUpgrade samba-test-libsUpgrade samba-test-debuginfoUpgrade samba-common-toolsUpgrade samba-clientUpgrade python3-samba-debuginfoUpgrade samba-test-libs-debuginfoUpgrade samba-testUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-winbind-modules-debuginfoUpgrade libwbclient-debuginfoUpgrade ctdb-tests-debuginfoUpgrade samba-vfs-glusterfs-debuginfoUpgrade ctdbUpgrade samba-winbindUpgrade samba-debugsourceUpgrade libsmbclient-develUpgrade python3-samba-testUpgrade sambaUpgrade ctdb-testsUpgrade samba-winbind-krb5-locatorUpgrade libsmbclient-debuginfoUpgrade samba-winbind-clients-debuginfoUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-debuginfoUpgrade libwbclient-develUpgrade samba-dcUpgrade samba-python-testUpgrade openchangeUpgrade samba-winbind-modulesUpgrade samba-winbind-debuginfoUpgrade samba-pythonUpgrade samba-common-libsUpgrade samba-client-debuginfoUpgrade samba-develUpgrade ctdb-debuginfoUpgrade samba-krb5-printing-debuginfoUpgrade samba-client-libs-debuginfoUpgrade openchange-debugsourceUpgrade samba-client-libsUpgrade samba-dc-libs | Apr 1, 2020 | Nov 6, 2019 |
| Debian | — | Upgrade samba | May 31, 2021 | Nov 6, 2019 |
| Freebsd | — | Upgrade samba410Upgrade samba411Upgrade samba48 | Nov 1, 2019 | Oct 29, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade samba-client-libsUpgrade samba-clientUpgrade sambaUpgrade libwbclientUpgrade samba-common-libsUpgrade libsmbclientUpgrade samba-winbindUpgrade samba-pythonUpgrade samba-common-toolsUpgrade samba-libsUpgrade samba-winbind-clientsUpgrade samba-commonUpgrade samba-winbind-modules | Sep 28, 2020 | Nov 6, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libwbclientUpgrade samba-commonUpgrade samba-client-libsUpgrade libsmbclientUpgrade samba-winbind-modulesUpgrade samba-common-toolsUpgrade samba-libsUpgrade samba-common-libsUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-pythonUpgrade sambaUpgrade samba-winbind | Dec 11, 2019 | Nov 6, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-libsUpgrade samba-winbindUpgrade samba-test-libsUpgrade samba-pidlUpgrade sambaUpgrade samba-common-libsUpgrade ctdbUpgrade samba-dc-libsUpgrade samba-commonUpgrade python3-samba-testUpgrade python2-sambaUpgrade samba-krb5-printingUpgrade samba-winbind-krb5-locatorUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade ctdb-testsUpgrade samba-common-toolsUpgrade python3-sambaUpgrade samba-winbind-modulesUpgrade libsmbclientUpgrade python2-samba-testUpgrade samba-testUpgrade samba-client-libsUpgrade libwbclient | Jan 3, 2020 | Nov 6, 2019 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.11.6-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.11.6-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 6, 2019 |
| Oracle_linux | — | Upgrade python3-samba-testUpgrade samba-winbind-modulesUpgrade libsmbclient-develUpgrade libwbclient-develUpgrade samba-commonUpgrade samba-winbind-clientsUpgrade ctdbUpgrade samba-develUpgrade samba-pythonUpgrade samba-winbind-krb5-locatorUpgrade openchangeUpgrade ctdb-testsUpgrade samba-libsUpgrade samba-winbindUpgrade samba-vfs-glusterfsUpgrade sambaUpgrade samba-common-toolsUpgrade samba-dc-libsUpgrade libsmbclientUpgrade samba-common-libsUpgrade samba-client-libsUpgrade samba-python-testUpgrade libwbclientUpgrade samba-dcUpgrade samba-pidlUpgrade samba-test-libsUpgrade samba-testUpgrade python3-sambaUpgrade samba-krb5-printingUpgrade samba-client | Oct 5, 2022 | Oct 29, 2019 |
| Redhat_linux | — | Upgrade samba-winbind-debuginfoUpgrade samba-libs-debuginfoUpgrade samba-testUpgrade python3-samba-debuginfoUpgrade samba-krb5-printingUpgrade libwbclient-debuginfoUpgrade samba-common-toolsUpgrade ctdbUpgrade ctdb-tests-debuginfoUpgrade samba-debuginfoUpgrade samba-winbind-clientsUpgrade samba-vfs-glusterfsUpgrade samba-libsUpgrade samba-winbind-krb5-locatorUpgrade samba-dc-libsUpgrade samba-winbind-modules-debuginfoUpgrade samba-test-libs-debuginfoUpgrade samba-common-libsUpgrade samba-develUpgrade samba-test-libsUpgrade samba-clientUpgrade libsmbclient-develUpgrade samba-client-debuginfoUpgrade python3-samba-testNo solution existsUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-vfs-glusterfs-debuginfoUpgrade samba-common-tools-debuginfoUpgrade samba-python-testUpgrade samba-commonUpgrade samba-test-debuginfoUpgrade samba-dcUpgrade samba-debugsourceUpgrade openchangeUpgrade sambaUpgrade openchange-debuginfoUpgrade samba-client-libs-debuginfoUpgrade samba-winbindUpgrade samba-winbind-clients-debuginfoUpgrade libwbclient-develUpgrade libsmbclientUpgrade samba-winbind-modulesUpgrade ctdb-testsUpgrade samba-pidlUpgrade libwbclientUpgrade openchange-debugsourceUpgrade ctdb-debuginfoUpgrade samba-client-libsUpgrade samba-common-libs-debuginfoUpgrade libsmbclient-debuginfoUpgrade python3-sambaUpgrade samba-pythonUpgrade openchange-client-debuginfoUpgrade samba-krb5-printing-debuginfo | Apr 1, 2020 | Nov 6, 2019 |
| Samba | — | Upgrade to Samba 4.10.10 or later.Upgrade to Samba 4.9.15 or later.Upgrade to Samba 4.11.2 or later. | Nov 6, 2019 | Nov 6, 2019 |
| Suse | — | Upgrade libndr-krb5pac0-32bitUpgrade libwbclient0Upgrade libdcerpc-binding0Upgrade ldapsmbUpgrade samba-pythonUpgrade libsmbclient-develUpgrade libtevent-util0-32bitUpgrade libsamdb0Upgrade libndr-nbt0Upgrade samba-winbind-32bitUpgrade python-ldbUpgrade libwbclient-develUpgrade libsmbldap0Upgrade libtdb1-32bitUpgrade libnetapi-develUpgrade libdcerpc-samr-develUpgrade libsmbldap2Upgrade samba-ad-dcUpgrade libsamba-hostconfig0Upgrade libsmbclient0Upgrade libnetapi0-32bitUpgrade sambaUpgrade libdcerpc-develUpgrade samba-krb-printingUpgrade libnetapi0Upgrade libndr-krb5pac-develUpgrade libndr-nbt-develUpgrade libndr0-32bitUpgrade ctdb-pcp-pmdaUpgrade samba-clientUpgrade libsamba-policy-python3-develUpgrade libsamba-errors0-32bitUpgrade libdcerpc-samr0-32bitUpgrade libsmbldap0-32bitUpgrade libsamba-policy-develUpgrade libsamba-passdb0-32bitUpgrade libsmbldap2-32bitUpgrade libsamba-credentials0-32bitUpgrade samba-core-develUpgrade samba-libs-python3Upgrade samba-libs-32bitUpgrade libtalloc2-32bitUpgrade libldb-develUpgrade libsamba-util-develUpgrade libregistry0Upgrade samba-python3Upgrade libndr-krb5pac0Upgrade libwbclient0-32bitUpgrade libsmbclient-raw0-32bitUpgrade libdcerpc0-32bitUpgrade libsamba-policy0-python3-32bitUpgrade libsmbclient0-32bitUpgrade libdcerpc-atsvc0Upgrade samba-ad-dc-32bitUpgrade libsmbconf-develUpgrade samba-docUpgrade libsamba-util0Upgrade libsamba-hostconfig0-32bitUpgrade libtevent-util0Upgrade libsamba-errors0Upgrade libsamba-credentials-develUpgrade samba-winbindUpgrade libtdb1Upgrade libndr-standard0Upgrade libldb1-32bitUpgrade samba-kdc-32bitUpgrade libsamba-credentials0Upgrade libndr0Upgrade samba-kdcUpgrade libndr-standard0-32bitUpgrade samba-libs-pythonUpgrade libsmbconf0-32bitUpgrade libsamba-policy-python-develUpgrade samba-dsdb-modulesUpgrade libsamba-policy0-python3Upgrade libldb1Upgrade libsmbconf0Upgrade libtalloc2Upgrade libsamba-passdb-develUpgrade libsamba-policy0-32bitUpgrade libsamba-util0-32bitUpgrade samba-libs-python-32bitUpgrade libgensec0-32bitUpgrade libndr-standard-develUpgrade ctdb-testsUpgrade libdcerpc0Upgrade libsamba-hostconfig-develUpgrade libgensec0Upgrade samba-cephUpgrade samba-client-32bitUpgrade libsamdb-develUpgrade samba-testUpgrade ldb-toolsUpgrade libsamba-errors-develUpgrade libdcerpc-binding0-32bitUpgrade libsamba-passdb0Upgrade libndr1Upgrade samba-32bitUpgrade libndr-nbt0-32bitUpgrade libsamba-policy0Upgrade libndr-develUpgrade libsmbclient-raw0Upgrade libsmbldap-develUpgrade libtevent0-32bitUpgrade libndr1-32bitUpgrade libtevent-util-develUpgrade libtevent0Upgrade samba-libsUpgrade ctdbUpgrade samba-pidlUpgrade python-ldb-develUpgrade libdcerpc-samr0Upgrade libsamdb0-32bitUpgrade samba-libs-python3-32bit | Oct 30, 2019 | Oct 29, 2019 |
| Ubuntu | — | Upgrade samba (Ubuntu Pro)Upgrade libsmbclientUpgrade sambaUpgrade libsmbclient (Ubuntu Pro) | Oct 30, 2019 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub