CVE-2021-44141: Infoleak
First published: Wed Jan 26 2022(Updated: )
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Samba Samba | <4.15.5 | |
| Redhat Storage | =3.0 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security.gentoo.org/glsa/202309-06
- https://www.samba.org/samba/security/CVE-2021-44141.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2048566
- https://access.redhat.com/errata/RHSA-2022:1756
- https://access.redhat.com/errata/RHSA-2022:2074
- https://access.redhat.com/security/cve/cve-2021-44141
- https://bugzilla.redhat.com/show_bug.cgi?id=2046120
Frequently Asked Questions
What is CVE-2021-44141?
CVE-2021-44141 is a vulnerability in Samba that allows a malicious client to determine if a file or directory exists in the server file system.
How does CVE-2021-44141 work?
CVE-2021-44141 works by using a server symlink to check if a file or directory exists in an area of the server file system not exported under the share definition.
Which versions of Samba are affected by CVE-2021-44141?
All versions of Samba prior to 4.15.5 are affected by CVE-2021-44141.
What is the severity of CVE-2021-44141?
The severity of CVE-2021-44141 is medium, with a severity score of 4.3.
How can I fix CVE-2021-44141?
To fix CVE-2021-44141, update your Samba software to version 4.15.5 or later.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-api
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-44141
- agent/software-canonical-lookup
- vendor/samba
- canonical/samba samba
- vendor/redhat
- canonical/redhat storage
- version/redhat storage/3.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- package-manager/redhat