CVE-2023-3961 Samba: smbd allows client access to unix domain sockets on the file system as root
Samba allows path traversal in pipe names, enabling clients to connect as root to external Unix domain sockets, leading to unauthorized access or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3961?
CVE-2023-3961 is a critical path traversal vulnerability in Fedoraproject Fedora, published on 3 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.
Weakness: CWE-22
Which versions are affected by CVE-2023-3961?
It affects 5 products.
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Storage, Samba Samba.
How do I fix CVE-2023-3961?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-3961 being exploited?
There is no known exploitation of CVE-2023-3961 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-3961, AZL-31899, AZL-37024, CLSA-2023-1700833977, CLSA-2023-1700834265, CLSA-2023-1700834882 and 7 more.