CVE-2019-10218 Path traversal in samba

Medium 5.3 Published 6 Nov 2019 Updated 4 Aug 2024

A malicious Samba server can trick the client into accessing or creating files outside the intended directory via path traversal.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-10218?

CVE-2019-10218 is a medium-severity path traversal vulnerability in Fedoraproject Fedora, published on 6 Nov 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.

Weakness: CWE-22

Which versions are affected by CVE-2019-10218?

It affects 2 products.

Linux distribution packages (29)

`samba` SUSE:Enterprise Storage 5	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:HPE Helion OpenStack 8	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise Desktop 12 SP4	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise High Availability Extension 12 SP1	All versions	`4.2.4-28.36.1`
`samba` SUSE:Linux Enterprise High Availability Extension 12 SP2	All versions	`4.4.2-38.28.1`
`samba` SUSE:Linux Enterprise High Availability Extension 12 SP3	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise High Availability Extension 12 SP4	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`3.6.3-94.23.1`
`samba-doc` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`3.6.3-94.23.1`
`samba` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`3.6.3-94.23.1`
`samba-doc` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`3.6.3-94.23.1`
`samba` SUSE:Linux Enterprise Server 12 SP1-LTSS	All versions	`4.2.4-28.36.1`
`samba` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`4.2.4-28.36.1`
`samba` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`4.4.2-38.28.1`
`samba` SUSE:Linux Enterprise Server 12 SP2-LTSS	All versions	`4.2.4-28.36.1`
`samba` SUSE:Linux Enterprise Server 12 SP2-LTSS	All versions	`4.4.2-38.28.1`
`samba` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise Server 12 SP4	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	All versions	`4.2.4-28.36.1`
`samba` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`4.2.4-28.36.1`
`samba` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`4.4.2-38.28.1`
`samba` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:Linux Enterprise Software Development Kit 12 SP4	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:OpenStack Cloud 7	All versions	`4.2.4-28.36.1`
`samba` SUSE:OpenStack Cloud 7	All versions	`4.4.2-38.28.1`
`samba` SUSE:OpenStack Cloud 8	All versions	`4.6.16+git.169.064abe062be-3.46.1`
`samba` SUSE:OpenStack Cloud Crowbar 8	All versions	`4.6.16+git.169.064abe062be-3.46.1`

Products include Fedoraproject Fedora, Samba Samba.

How do I fix CVE-2019-10218?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-10218 being exploited?

There is no known exploitation of CVE-2019-10218 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALPINE-CVE-2019-10218, DEBIAN-CVE-2019-10218, ECHO-5bf5-38e9-da43, GHSA-mjrv-7h6w-94x4, SUSE-SU-2019:14202-1, SUSE-SU-2019:2875-1 and 3 more.