Headline
CVE-2019-10218: Samba - Security Announcement Archive
A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.
CVE-2019-10218.html:
=========================================================== == Subject: Client code can return filenames containing == path separators. == == CVE ID#: CVE-2019-10218 == == Versions: All versions of Samba. == == Summary: Malicious servers can cause Samba client code to return filenames containing path separators to calling code. ===========================================================
=========== Description ===========
Samba client code (libsmbclient) returns server-supplied filenames to calling code without checking for pathname separators (such as “/” or “…/”) in the server returned names.
A malicious server can craft a pathname containing separators and return this to client code, causing the client to use this access local pathnames for reading or writing instead of SMB network pathnames.
This access is done using the local privileges of the client.
This attack can be achieved using any of SMB1/2/3 as it is not reliant on any specific SMB protocol version.
Specifically, samba client tools like smbget and smbclient’s mget use the server supplied ‘final’ name component as a local name when obtaining multiple files. While the design of these tools is that server can always choose the file names, this vulnerability is that it allows a remote server to create local files outside the current working directory.
Users of the libsmbclient library external to Samba may also be vulnerable if they use server returned filenames without adequate checking and pass them to functions that do local filesystem access.
Note that the Gnome GVFS client library is not believed to be vulnerable, as it always passes server-returned pathnames back to the SMB share they were returned from. Such malformed pathnames are then rejected by the server.
================== Patch Availability ==================
Patches addressing both these issues have been posted to:
http://www.samba.org/samba/security/
Additionally, Samba 4.11.2, 4.10.10 and 4.9.15 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible.
================== CVSSv3 calculation ==================
CVSSv3: AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N (5.3)
========== Workaround ==========
None.
======= Credits =======
Originally reported by Michael Hanselmann.
Patches provided by Jeremy Allison of the Samba Team and Google.
Advisory by Jeremy Allison of the Samba Team and Google and Andrew Bartlett of the Samba Team and Catalyst.
========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ==========================================================
Related news
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.