Improper Authorization in Samba - CVE-2023-3961

Vulnerability identifier: #VU81875

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3961

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when handling client pipe names. A remote attacker can provide a specially crafted pipe name containing directory traversal characters and force Samba to connect to Unix domain sockets outside of the private directory meant to restrict the services a client could connect to.The connection to Unix domain sockets is performed as root, which means that if client sends a pipe name that resolved to an external service using an existing Unix domain socket, the client is able to connect to it without any filesystem restrictions.

Samba
Gentoo Linux
Amazon Linux AMI
Oracle Linux
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Slackware Linux
Basesystem Module
openSUSE Leap
openEuler
Fedora
Red Hat OpenShift Container Platform
JD Edwards EnterpriseOne Tools
Security Event Manager (SEM)
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
samba (Red Hat package)
samba
samba-pidl
python3-samba-test
python3-samba-devel
python3-samba-dc
python3-samba
libwbclient-devel
libwbclient
libsmbclient-devel
libsmbclient
libnetapi
ctdb
samba-client-libs
samba-vfs-iouring
samba-winbind
samba-winbind-clients
samba-winbind-krb5-locator
samba-winbind-modules
samba-winexe
samba-common
samba-client
samba-tools
samba-test-libs
samba-libs
samba-ldb-ldap-modules
samba-krb5-printing
samba-devel
samba-dcerpc
samba-dc-libs
samba-common-tools
samba-common-libs
samba-test
samba-dc-provision
samba-dc-bind-dlz
samba-help
samba-dc
samba-debugsource
samba-usershares
samba-debuginfo
samba-vfs-glusterfs
samba-gpupdate
samba-libs-python3
samba-libs-32bit
samba-client-libs-32bit-debuginfo
samba-client-32bit
samba-client-libs-32bit
samba-winbind-libs-debuginfo
samba-python3
samba-devel-32bit
samba-tool
samba-test-debuginfo
samba-libs-python3-debuginfo
ctdb-debuginfo
samba-ldb-ldap-debuginfo
samba-libs-python3-32bit-debuginfo
libsamba-policy-python3-devel
samba-python3-debuginfo
ctdb-pcp-pmda
ctdb-pcp-pmda-debuginfo
samba-libs-debuginfo
samba-winbind-libs
libsamba-policy0-python3
libsamba-policy-devel
samba-ldb-ldap
samba-client-libs-64bit
samba-client-libs-debuginfo
samba-winbind-debuginfo
samba-client-debuginfo
libsamba-policy0-python3-debuginfo
samba-libs-python3-64bit
samba-libs-python3-64bit-debuginfo
samba-client-64bit-debuginfo
samba-client-64bit
samba-libs-64bit
samba-client-libs-64bit-debuginfo
samba-devel-64bit
libsamba-policy0-python3-64bit
libsamba-policy0-python3-32bit-debuginfo
samba-libs-64bit-debuginfo
samba-client-32bit-debuginfo
samba-winbind-libs-32bit-debuginfo
samba-libs-python3-32bit
samba-libs-32bit-debuginfo
samba-winbind-libs-32bit
libsamba-policy0-python3-32bit
samba-doc
samba-ceph-debuginfo
samba-ceph
samba-winbind-libs-64bit-debuginfo
samba-winbind-libs-64bit
libsamba-policy0-python3-64bit-debuginfo
samba (Debian package)
libnetapi-devel
net-fs/samba
HP-UX Common Internet File System (CIFS)
IBM Cloud Pak for Watson AIOps
Storage Scale
QuTS hero
QNAP QTS

Install updates from vendor's website.

Samba - addressed in versions 4.17.12, 4.18.8, 4.19.1
Red Hat OpenShift Container Platform - addressed in versions 4.11.54, 4.12.45, 4.13.24, 4.14.4
Security Event Manager (SEM) - update to 2023.4.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
JD Edwards EnterpriseOne Tools - update to 9.2.9.2
HP-UX Common Internet File System (CIFS) - update to B.04.18.01.00
QuTS hero - update to h5.1.3.2578 build 20231110
IBM Cloud Pak for Watson AIOps - update to 4.4.0
samba (Red Hat package) - addressed in versions 4.15.5-13.el8_6, 4.15.5-111.el9_0, 4.17.5-4.el8_8, 4.18.6-2.el8_9, 4.18.6-101.el9_3
samba - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-pidl - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
python3-samba-test - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
python3-samba-devel - addressed in versions 4.17.5-5.0.1, 4.18.8-1
python3-samba-dc - addressed in versions 4.17.5-5.0.1, 4.18.8-1
python3-samba - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
libwbclient-devel - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
libwbclient - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
libsmbclient-devel - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
libsmbclient - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
libnetapi - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
ctdb - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-client-libs - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-vfs-iouring - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-winbind - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-winbind-clients - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-winbind-krb5-locator - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-winbind-modules - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-winexe - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1
samba-common - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-client - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-tools - addressed in versions 4.17.5-5.0.1, 4.18.8-1
samba-test-libs - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-libs - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-ldb-ldap-modules - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-krb5-printing - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-devel - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-dcerpc - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-dc-libs - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-common-tools - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-common-libs - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-test - addressed in versions 4.17.5-5.0.1, 4.18.6-1.0.1, 4.18.8-1
samba-dc-provision - update to 4.17.5-8
libwbclient-devel - update to 4.17.5-8
samba-common - update to 4.17.5-8
samba-winbind-krb5-locator - update to 4.17.5-8
samba-winbind-modules - update to 4.17.5-8
samba-dc-bind-dlz - update to 4.17.5-8
samba - update to 4.17.5-8
samba-test - update to 4.17.5-8
samba-libs - update to 4.17.5-8
samba-krb5-printing - update to 4.17.5-8
samba-client - update to 4.17.5-8
samba-help - update to 4.17.5-8
samba-client-libs - update to 4.17.5-8
python3-samba-test - update to 4.17.5-8
libsmbclient-devel - update to 4.17.5-8
samba-dc - update to 4.17.5-8
libwbclient - update to 4.17.5-8
python3-samba - update to 4.17.5-8
samba-dc-libs - update to 4.17.5-8
samba-common-tools - update to 4.17.5-8
samba-winbind - update to 4.17.5-8
samba-debugsource - update to 4.17.5-8
samba-usershares - update to 4.17.5-8
ctdb - update to 4.17.5-8
python3-samba-dc - update to 4.17.5-8
samba-devel - update to 4.17.5-8
samba-debuginfo - update to 4.17.5-8
samba-winbind-clients - update to 4.17.5-8
libsmbclient - update to 4.17.5-8
samba-vfs-glusterfs - update to 4.17.5-8
samba-pidl - update to 4.17.5-8
samba-gpupdate - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-python3 - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-32bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-libs-32bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-32bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-libs-32bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind-libs-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-python3 - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-devel-32bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-test - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
ctdb - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-tool - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-test-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-python3-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
ctdb-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-ldb-ldap-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-python3-32bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy-python3-devel - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-python3-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
ctdb-pcp-pmda - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
ctdb-pcp-pmda-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind-libs - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-devel - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy0-python3 - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy-devel - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-ldb-ldap - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-libs-64bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-libs - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-libs-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-debugsource - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy0-python3-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-python3-64bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-python3-64bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-64bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-64bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-64bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-libs-64bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-devel-64bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy0-python3-64bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy0-python3-32bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-64bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-client-32bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind-libs-32bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-python3-32bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-libs-32bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind-libs-32bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy0-python3-32bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-doc - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-ceph-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-ceph - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind-libs-64bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba-winbind-libs-64bit - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
libsamba-policy0-python3-64bit-debuginfo - update to 4.17.9+git.421.abde31ca5c2-150500.3.11.1
samba (Debian package) - update to 2:4.17.12+dfsg-0+deb12u1
samba - update to 4.17.12-1
samba - addressed in versions 4.17.12-1.fc37, 4.18.8-1.fc38, 4.19.1-1.fc39
samba - update to 4.18.8
libnetapi-devel - update to 4.18.8-1
samba-dc-provision - update to 4.18.8-1
samba-dc - update to 4.18.8-1
samba-vfs-glusterfs - update to 4.18.8-1
samba-usershares - update to 4.18.8-1
samba-gpupdate - update to 4.18.8-1
samba-dc-bind-dlz - update to 4.18.8-1
net-fs/samba - update to 4.18.9
QNAP QTS - update to 5.1.3.2578 20231110
Storage Scale - update to 5.1.9.2

• https://www.samba.org/samba/security/CVE-2023-3961.html

• Multiple vulnerabilities in Samba
• Slackware Linux update for samba
• SUSE update for samba
• Fedora 39 update for samba
• Fedora 38 update for samba
• Fedora 37 update for samba
• Debian update for samba
• Red Hat Enterprise Linux 9.0 Extended Update Support update for samba
• Red Hat Enterprise Linux 9 update for samba
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for samba
• Red Hat Enterprise Linux 8.6 Extended Update Support update for samba
• Red Hat Enterprise Linux 8.8 Extended Update Support update for samba
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in QNAP QTS and QuTS hero
• Gentoo update for Samba
• SolarWinds Security Event Manager (SEM) update for third-party components
• openEuler 22.03 LTS SP1 update for samba
• openEuler 22.03 LTS SP2 update for samba
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Amazon Linux AMI update for samba
• Multiple vulnerabilities in HP-UX Common Internet File System (CIFS)
• Anolis OS update for samba
• Anolis OS update for samba
• Anolis OS update for samba
• Multiple vulnerabilities in IBM Storage Scale