CVE-2010-0926
NoneCVSS
—
EPSS
30.4%
Published
Mar 10, 2010
CISA due date
—
The record
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | samba | 0 | 2:3.4.6~dfsg-1 |
| Debian:11 | samba | 0 | 2:3.4.6~dfsg-1 |
| Debian:12 | samba | 0 | 2:3.4.6~dfsg-1 |
| Debian:13 | samba | 0 | 2:3.4.6~dfsg-1 |
| Red Hat:enterprise_linux:5::client | libsmbclient | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client | libsmbclient-devel | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client | samba | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client | samba-client | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client | samba-common | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client | samba-debuginfo | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client | samba-swat | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libsmbclient | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client_workstation | libsmbclient-devel | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client_workstation | samba | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client_workstation | samba-client | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client_workstation | samba-common | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client_workstation | samba-debuginfo | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::client_workstation | samba-swat | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::server | libsmbclient | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::server | libsmbclient-devel | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::server | samba | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::server | samba-client | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::server | samba-common | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::server | samba-debuginfo | 0 | 0:3.0.33-3.37.el5 |
| Red Hat:enterprise_linux:5::server | samba-swat | 0 | 0:3.0.33-3.37.el5 |
| openSUSE:Tumbleweed | samba | 0 | 4.5.0-1.1 |
Related vulnerabilities
- CVE-2014-0178 Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain… Also affects samba
- CVE-2013-4124 Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x… Also affects samba
- CVE-2011-2522 Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web… Also affects samba
- CVE-2010-2063 Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in… Also affects samba
- CVE-2008-1105 Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0… Also affects samba
- CVE-2007-6015 Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through… Also affects samba
- CVE-2007-5398 Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c… Also affects samba
- CVE-2007-2446 Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through… Also affects samba