CVE-2023-3961
CVE-2023-3961 · Samba: smbd allows client access to unix domain sockets on the file system as root
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.
CVSS 9.1 · Critique · EPSS 2,7% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
red hat enterprise linux 8
- Versions du logiciel
- ≥ 0:4.18.6-2.el8_9: Non concernée (rpm)
Aucun correctif publié
red hat enterprise linux 8.6 extended update support
- Versions du logiciel
- ≥ 0:4.15.5-13.el8_6: Non concernée (rpm)
Aucun correctif publié
red hat enterprise linux 8.8 extended update support
- Versions du logiciel
- ≥ 0:4.17.5-4.el8_8: Non concernée (rpm)
Aucun correctif publié
red hat enterprise linux 9
- Versions du logiciel
- ≥ 0:4.18.6-101.el9_3: Non concernée (rpm)
Aucun correctif publié
red hat enterprise linux 9.0 extended update support
- Versions du logiciel
- ≥ 0:4.15.5-111.el9_0: Non concernée (rpm)
Aucun correctif publié
red hat enterprise linux 9.2 extended update support
- Versions du logiciel
- ≥ 0:4.17.5-104.el9_2: Non concernée (rpm)
Aucun correctif publié
red hat virtualization 4 for red hat enterprise linux 8
- Versions du logiciel
- ≥ 0:4.15.5-13.el8_6: Non concernée (rpm)
Aucun correctif publié
red hat enterprise linux 6
Aucun correctif publié
red hat enterprise linux 7
Aucun correctif publié
red hat storage 3
Aucun correctif publié
samba Debian:12
- Versions du logiciel
- 2:4.17.10+dfsg-0+deb12u1
- 2:4.17.10+dfsg-0+deb12u1~bpo11+1
- 2:4.17.11+dfsg-0+deb12u1
- 2:4.17.12+dfsg-0+deb12u1~bpo11+1
- 2:4.17.8+dfsg-2
- 2:4.17.8+dfsg-2.1
- 2:4.17.9+dfsg-0+deb12u1
- 2:4.17.9+dfsg-0+deb12u2
- 2:4.17.9+dfsg-0+deb12u3
- 2:4.17.9+dfsg-0+deb12u3~bpo11+1
- Plages de versions concernées
- ECOSYSTEM: < 2:4.17.12+dfsg-0+deb12u1
Mettez à jour vers 2:4.17.12+dfsg-0+deb12u1
samba Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 2:4.19.1+dfsg-1
Mettez à jour vers 2:4.19.1+dfsg-1
samba Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 2:4.19.1+dfsg-1
Mettez à jour vers 2:4.19.1+dfsg-1
Sources originales
- https://access.redhat.com/errata/RHSA-2023:6209
- https://access.redhat.com/errata/RHSA-2023:6744
- https://access.redhat.com/errata/RHSA-2023:7371
- https://access.redhat.com/errata/RHSA-2023:7408
- https://access.redhat.com/errata/RHSA-2023:7464
- https://access.redhat.com/errata/RHSA-2023:7467
- https://access.redhat.com/security/cve/CVE-2023-3961
- https://bugzilla.redhat.com/show_bug.cgi?id=2241881
- https://bugzilla.samba.org/show_bug.cgi?id=15422
- https://www.samba.org/samba/security/CVE-2023-3961.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZUMVALLFFDFC53JZMUWA6HPD7HUGAP5I/
- https://security.netapp.com/advisory/ntap-20231124-0002/
- https://nvd.nist.gov/vuln/detail/CVE-2023-3961