Samba up to 4.17.11/4.18.7/4.19.0 smbd path traversal

Summaryinfo

A vulnerability has been found in Samba up to 4.17.11/4.18.7/4.19.0 and classified as critical. This impacts an unknown function of the component smbd. Performing a manipulation results in an unknown weakness. This vulnerability is known as CVE-2023-3961. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Samba up to 4.17.11/4.18.7/4.19.0 (File Transfer Software). This affects an unknown part of the component smbd. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on integrity. The summary by CVE is:

A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.

The weakness was published 10/11/2023. The advisory is shared at bugzilla.samba.org. This vulnerability is uniquely identified as CVE-2023-3961 since 07/26/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 239932 (TencentOS Server 4: samba (TSSA-2025:0014)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.17.12, 4.18.8 or 4.19.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (239932) and EUVD (EUVD-2023-44586). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• File Transfer Software

Name

• Samba

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17
• 4.17.0
• 4.17.1
• 4.17.2
• 4.17.3
• 4.17.4
• 4.17.5
• 4.17.6
• 4.17.7
• 4.17.8
• 4.17.9
• 4.17.10
• 4.17.11
• 4.18
• 4.18.0
• 4.18.1
• 4.18.2
• 4.18.3
• 4.18.4
• 4.18.5
• 4.18.6
• 4.18.7
• 4.19.0

License

• open-source

Website

• Product: https://www.samba.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion