All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.
References
| Link | Resource |
|---|---|
| https://bugzilla.samba.org/show_bug.cgi?id=13979 | Exploit Issue Tracking Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220110-0001/ | Third Party Advisory |
| https://www.samba.org/samba/security/CVE-2021-43566.html | Patch Vendor Advisory |
| https://bugzilla.samba.org/show_bug.cgi?id=13979 | Exploit Issue Tracking Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220110-0001/ | Third Party Advisory |
| https://www.samba.org/samba/security/CVE-2021-43566.html | Patch Vendor Advisory |
Configurations
History
21 Nov 2024, 06:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.samba.org/show_bug.cgi?id=13979 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20220110-0001/ - Third Party Advisory | |
| References | () https://www.samba.org/samba/security/CVE-2021-43566.html - Patch, Vendor Advisory |
Information
Published : 2022-01-11 16:15
Updated : 2024-11-21 06:29
NVD link : CVE-2021-43566
Mitre link : CVE-2021-43566
CVE.ORG link : CVE-2021-43566
JSON object : View
Products Affected
samba
- samba
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')