CVE-2009-0022: Input Validation
Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable registry shares in the Samba configuration (ensure registry shares are not enabled). This prevents remote authenticated users from exploiting a crafted connection request with a blank share name to access the root filesystem.
Samba registry shares = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0022?
CVE-2009-0022 is considered a medium severity vulnerability due to potential unauthorized access to the root filesystem.
How do I fix CVE-2009-0022?
To fix CVE-2009-0022, upgrade to Samba version 3.2.7 or later, which resolves the issue.
Who is affected by CVE-2009-0022?
CVE-2009-0022 affects users of Samba versions 3.2.0 through 3.2.6 that have registry shares enabled.
What type of vulnerability is CVE-2009-0022?
CVE-2009-0022 is a security vulnerability that allows remote authenticated users to access unauthorized files.
What is the exploit method for CVE-2009-0022?
The exploit method for CVE-2009-0022 involves sending a crafted connection request with a blank share name.