Link following in Samba - CVE-2021-44141

Vulnerability identifier: #VU60187

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-44141

CWE-ID: CWE-59

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Samba
Gentoo Linux
Amazon Linux AMI
Oracle Solaris
SUSE Linux Enterprise Micro
Red Hat CodeReady Linux Builder for x86_64
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Python2
openEuler
Fedora
Dell Secure Connect Gateway
tevent-man
tevent-debugsource
libtevent-devel
libtevent0
libtevent0-debuginfo
libtevent0-32bit
libtevent0-32bit-debuginfo
python3-tevent
python3-tevent-debuginfo
p11-kit-devel
p11-kit-tools-debuginfo
p11-kit-tools
p11-kit-nss-trust
p11-kit
libp11-kit0-debuginfo
libp11-kit0
p11-kit-debugsource
p11-kit-debuginfo
p11-kit-debuginfo-32bit
p11-kit-32bit
libp11-kit0-32bit
libp11-kit0-debuginfo-32bit
python3-tdb
libtdb1-debuginfo
libtdb1
libtdb-devel
python3-tdb-debuginfo
libtdb1-32bit-debuginfo
libtdb1-32bit
tdb-tools-debuginfo
tdb-tools
tdb-debugsource
sssd-krb5-common-debuginfo
libsss_idmap0-debuginfo
libsss_idmap0
libsss_certmap0-debuginfo
libsss_certmap0
sssd-dbus
sssd-dbus-debuginfo
libipa_hbac0-debuginfo
libipa_hbac0
sssd-ipa
sssd-ipa-debuginfo
sssd-krb5
sssd-krb5-common
python-sssd-config-debuginfo
sssd-krb5-debuginfo
sssd-ldap
sssd-ldap-debuginfo
sssd-proxy
sssd-proxy-debuginfo
sssd-debugsource
sssd-tools
sssd-tools-debuginfo
libsss_nss_idmap-devel
libsss_idmap-devel
libipa_hbac-devel
sssd-common
libsss_nss_idmap0
sssd
python-sssd-config
libsss_nss_idmap0-debuginfo
libsss_simpleifp0
sssd-common-debuginfo
sssd-ad-debuginfo
libsss_simpleifp0-debuginfo
sssd-ad
libsss_simpleifp-devel
python3-sssd-config
python3-sssd-config-debuginfo
sssd-winbind-idmap-debuginfo
sssd-winbind-idmap
libsss_certmap-devel
krb5-plugin-kdb-ldap
krb5-debugsource
krb5-debuginfo
krb5-plugin-preauth-pkinit
krb5-32bit
krb5-32bit-debuginfo
krb5-plugin-kdb-ldap-debuginfo
krb5-server
krb5-server-debuginfo
krb5
krb5-client
krb5-client-debuginfo
krb5-devel
krb5-plugin-preauth-otp
krb5-plugin-preauth-otp-debuginfo
krb5-plugin-preauth-spake-debuginfo
krb5-plugin-preauth-spake
krb5-plugin-preauth-pkinit-debuginfo
ca-certificates
talloc-man
libtalloc2-32bit-debuginfo
libtalloc2-32bit
python3-talloc-debuginfo
talloc-debugsource
python3-talloc
python3-talloc-devel
libtalloc2-debuginfo
libtalloc2
libtalloc-devel
ldb-debugsource
python3-ldb
python3-ldb-debuginfo
python3-ldb-devel
libldb2-debuginfo
libldb2
libldb-devel
ldb-tools-debuginfo
libldb2-32bit
libldb2-32bit-debuginfo
ldb-tools
libapparmor1-debuginfo
libapparmor1
apparmor-parser-debuginfo
apparmor-parser
pam_apparmor-32bit
apache2-mod_apparmor-debuginfo
apache2-mod_apparmor
pam_apparmor
perl-apparmor
pam_apparmor-debuginfo
perl-apparmor-debuginfo
libapparmor-devel
apparmor-utils
apparmor-profiles
apparmor-docs
apparmor-debugsource
libapparmor1-32bit
libapparmor1-debuginfo-32bit
pam_apparmor-debuginfo-32bit
libapparmor1-32bit-debuginfo
libapparmor-debugsource
python3-apparmor-debuginfo
python3-apparmor
pam_apparmor-32bit-debuginfo
apparmor-abstractions
apparmor-parser-lang
apparmor-utils-lang
libnettle-debugsource
libnettle6-32bit
libnettle6-debuginfo-32bit
libhogweed4-debuginfo-32bit
libhogweed4-32bit
libhogweed4
libhogweed4-debuginfo
libnettle6
libnettle6-debuginfo
yast2-samba-client
gnutls-debugsource
libgnutls30
libgnutls30-debuginfo
libgnutls30-debuginfo-32bit
libgnutls30-32bit
samba
samba-winbind
samba-vfs-glusterfs
samba-dc-bind-dlz
samba-client
samba-dc-provision
samba-help
samba-devel
samba-common-tools
libwbclient-devel
samba-libs
ctdb-tests
python3-samba-test
samba-debugsource
libsmbclient
samba-winbind-clients
samba-pidl
libsmbclient-devel
python3-samba
samba-krb5-printing
samba-winbind-modules
libwbclient
samba-common
samba-winbind-krb5-locator
samba-debuginfo
ctdb
samba-dc
python3-samba-dc
samba-test
samba-client-libs-debuginfo
samba-libs-debuginfo
samba-client-libs
samba-client-debuginfo
samba-ldb-ldap
samba-ldb-ldap-debuginfo
samba-libs-python3
samba-libs-python3-debuginfo
samba-python3
samba-python3-debuginfo
samba-tool
samba-doc
samba-winbind-debuginfo
samba-winbind-libs
samba-winbind-libs-debuginfo
samba-libs-32bit
libsamba-policy-python3-devel
samba-devel-32bit
libsamba-policy0-python3-32bit
libsamba-policy0-python3-debuginfo-32bit
samba-client-32bit
samba-client-debuginfo-32bit
samba-client-libs-32bit
samba-client-libs-debuginfo-32bit
libsamba-policy0-python3
libsamba-policy0-python3-debuginfo
samba-libs-debuginfo-32bit
samba-libs-python3-32bit
samba-libs-python3-debuginfo-32bit
samba-winbind-libs-32bit
samba-winbind-libs-debuginfo-32bit
libsamba-policy-devel
ctdb-debuginfo
samba-libs-32bit-debuginfo
samba-client-libs-32bit-debuginfo
samba-client-32bit-debuginfo
samba-ad-dc-libs-32bit-debuginfo
samba-ad-dc-libs-32bit
samba-dsdb-modules-debuginfo
samba-gpupdate
samba-ceph
samba-ceph-debuginfo
samba-ad-dc-libs
samba-ad-dc
samba-ad-dc-debuginfo
samba-ad-dc-libs-debuginfo
samba-dsdb-modules
samba-winbind-libs-32bit-debuginfo
samba (Red Hat package)
samba-test-libs
samba-winexe
samba-common-libs
net-fs/samba
RAX30
SimpliVity Omnistack
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insecure link following. A remote user with ability to write files to the exported part of the file system under a share via SMB1 unix extensions or via NFS can create a symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition.

Install updates from vendor's website.

• https://www.samba.org/samba/security/CVE-2021-44141.html