ALT-PU-2022-2144-1
Closed vulnerabilities
Published: 2022-01-31
BDU:2022-00685
Уязвимость сетевой файловой системы Samba, связанная с неверным определением ссылки перед доступом к файл, позволяющая нарушителю получить доступ к конфиденциальной информации
Severity: MEDIUM (4.3)
Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References:
Published: 2022-08-23
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-20316
A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
Severity: MEDIUM (6.8)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
References:
- https://access.redhat.com/security/cve/CVE-2021-20316
- https://access.redhat.com/security/cve/CVE-2021-20316
- https://bugzilla.redhat.com/show_bug.cgi?id=2009673
- https://bugzilla.redhat.com/show_bug.cgi?id=2009673
- https://bugzilla.samba.org/show_bug.cgi?id=14842
- https://bugzilla.samba.org/show_bug.cgi?id=14842
- GLSA-202309-06
- GLSA-202309-06
- https://security-tracker.debian.org/tracker/CVE-2021-20316
- https://security-tracker.debian.org/tracker/CVE-2021-20316
- https://www.samba.org/samba/security/CVE-2021-20316.html
- https://www.samba.org/samba/security/CVE-2021-20316.html
Published: 2022-02-21
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-44141
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
Severity: MEDIUM (4.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References: