REDHAT-BUG-562568
First published: Sun Feb 07 2010(Updated: )
Security researcher called "Kingcope" pointed out: [1] <a href="http://seclists.org/fulldisclosure/2010/Feb/82">http://seclists.org/fulldisclosure/2010/Feb/82</a> [2] <a href="http://www.youtube.com/watch?v=NN50RtZ2N74">http://www.youtube.com/watch?v=NN50RtZ2N74</a> and detailed: [3] <a href="http://seclists.org/fulldisclosure/2010/Feb/99">http://seclists.org/fulldisclosure/2010/Feb/99</a> a deficiency in the behaviour of Samba server, providing SMB/CIFS services to the clients. Samba server, in the default configuration, is shipped with configuration file parameter "wide links" set to "yes" ("wide links = yes"). If a local user would first locally create a symbolic link, which target would point to some system sensitive file / directory and link name of this link would be placed into an exported Samba share, with write access for Samba users, this might allow a remote attacker to read, list and retrieve files, behind the target of the symbolic link. Samba upstream review of reasons and impact of this issue: [4] <a href="http://marc.info/?l=samba-technical&m=126539387432412&w=2">http://marc.info/?l=samba-technical&m=126539387432412&w=2</a> As mentioned in [4] the problem "is actually a default insecure configuration in Samba." and "comes from a combination of two features in Samba, each of which on their own are useful to Administrators". Workaround -- to prevent occurrence of this deficiency set: =========================================================== wide links = no in the [global] section of your smb.conf and restart the Samba (smbd) daemon. This will ensure, remote Samba clients will not follow symbolink links, exported in Samba shares, to their target anymore (thus prevent the potential disclosure of sensitive data).
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Samba |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/fulldisclosure/2010/Feb/82
- http://www.youtube.com/watch?v=NN50RtZ2N74
- http://seclists.org/fulldisclosure/2010/Feb/99
- http://marc.info/?l=samba-technical&m=126539387432412&w=2
- http://blog.metasploit.com/2010/02/exploiting-samba-symlink-traversal.html
- https://bugzilla.samba.org/show_bug.cgi?id=7104
- http://gitweb.samba.org/?p=samba.git;a=commitdiff;h=bd269443e311d96ef495a9db47d1b95eb83bb8f4
- https://access.redhat.com/security/cve/CVE-2010-0926
- http://www.samba.org/samba/news/symlink_attack.html
- http://www.samba.org/samba/history/samba-3.4.6.html
- http://www.samba.org/samba/history/samba-3.5.0.html
- https://rhn.redhat.com/errata/RHSA-2012-0313.html
- https://bugzilla.redhat.com/show_bug.cgi?id=562568
Frequently Asked Questions
What is the severity of REDHAT-BUG-562568?
The severity of REDHAT-BUG-562568 is considered significant as it impacts Samba and could lead to unauthorized access.
How do I fix REDHAT-BUG-562568?
To fix REDHAT-BUG-562568, ensure you update your Samba installation to the latest version provided by your distributor.
What systems are affected by REDHAT-BUG-562568?
REDHAT-BUG-562568 affects systems running Samba, particularly versions prior to the latest security patches.
What are the potential impacts of REDHAT-BUG-562568?
The potential impacts of REDHAT-BUG-562568 include data exposure and unauthorized remote access to your systems.
Is there a workaround for REDHAT-BUG-562568?
A temporary workaround for REDHAT-BUG-562568 is to restrict access to Samba shares and limit user permissions until a patch is applied.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-0926
- agent/source
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/samba
- canonical/samba