Path Traversal in Samba
CVE-2010-0926
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 3.5 (Low). Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.304 (98.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.305 · newest: 0.304 · change: -0.001
Affected products
- Samba — versions 3.3.3, 3.3.9, 3.3.10
Weakness classification (CWE)
Public proof-of-concept exploits
References
- archives.neohapsis.com/archives/fulldisclosure/2010-02/0083.html (mailing-list)
- archives.neohapsis.com/archives/fulldisclosure/2010-02/0107.html (mailing-list)
- archives.neohapsis.com/archives/fulldisclosure/2010-02/0108.html (mailing-list)
- blog.metasploit.com/2010/02/exploiting-samba-symlink-traversal.html
- gitweb.samba.org/
- lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html (vendor-advisory)
- lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html (vendor-advisory)
- marc.info/ (mailing-list)
- marc.info/ (mailing-list)
- marc.info/ (mailing-list)
Frequently asked questions
- What is CVE-2010-0926?
- CVE-2010-0926 is a vulnerability in Samba, classified under Path Traversal. Published 2010-03-10.
- Is CVE-2010-0926 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.