CVE-2021-43566: Race Condition
All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Samba vulnerability?
The vulnerability ID for this Samba vulnerability is CVE-2021-43566.
What is the severity of CVE-2021-43566?
The severity of CVE-2021-43566 is low, with a severity value of 2.5.
How does CVE-2021-43566 affect Samba?
CVE-2021-43566 affects all versions of Samba prior to 4.13.16.
What is the impact of CVE-2021-43566?
The impact of CVE-2021-43566 is that a malicious client can use an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition.
Are there any available fixes for CVE-2021-43566?
Yes, upgrading to Samba version 4.13.16 or later will fix the vulnerability.