CVE-2010-0926 Path traversal in n/a
Authenticated users can read arbitrary files via directory traversal in Samba when writable shares and specific link options are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-0926?
CVE-2010-0926 is a low-severity path traversal vulnerability in Samba Samba, published on 9 Mar 2010. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.
Weakness: CWE-22
Which versions are affected by CVE-2010-0926?
It affects 1 product.
Linux distribution packages (16)
libsmbclient Red Hat:enterprise_linux:5::client | All versions | 0:3.0.33-3.37.el5 |
samba Red Hat:enterprise_linux:5::client | All versions | 0:3.0.33-3.37.el5 |
samba-client Red Hat:enterprise_linux:5::client | All versions | 0:3.0.33-3.37.el5 |
samba-common Red Hat:enterprise_linux:5::client | All versions | 0:3.0.33-3.37.el5 |
samba-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:3.0.33-3.37.el5 |
samba-swat Red Hat:enterprise_linux:5::client | All versions | 0:3.0.33-3.37.el5 |
libsmbclient-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:3.0.33-3.37.el5 |
samba Red Hat:enterprise_linux:5::client_workstation | All versions | 0:3.0.33-3.37.el5 |
samba-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:3.0.33-3.37.el5 |
libsmbclient Red Hat:enterprise_linux:5::server | All versions | 0:3.0.33-3.37.el5 |
libsmbclient-devel Red Hat:enterprise_linux:5::server | All versions | 0:3.0.33-3.37.el5 |
samba Red Hat:enterprise_linux:5::server | All versions | 0:3.0.33-3.37.el5 |
samba-client Red Hat:enterprise_linux:5::server | All versions | 0:3.0.33-3.37.el5 |
samba-common Red Hat:enterprise_linux:5::server | All versions | 0:3.0.33-3.37.el5 |
samba-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:3.0.33-3.37.el5 |
samba-swat Red Hat:enterprise_linux:5::server | All versions | 0:3.0.33-3.37.el5 |
Products include Samba Samba.
How do I fix CVE-2010-0926?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2010-0926 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-0926 exists.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Other vulnerabilities in Samba Samba
Sources
Also known as DEBIAN-CVE-2010-0926, ECHO-bc72-4fe3-f30f, GHSA-c6j9-4944-rfw4, RHSA-2012:0313.