Attachment 17090 Details for Bug 14914 – CVE-2021-44142 Advisory v3

CVE-2021-44142 Advisory v3

CVE-2021-44142-advisory-v3.txt (text/plain), 1.97 KB, created by Ralph Böhme on 2022-01-14 19:18:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ralph Böhme

Created: 2022-01-14 19:18:14 UTC

Size: 1.97 KB

patch

obsolete

>=================================================================
>== Subject:     Out-of-bounds heap read/write vulnerability
>==              in VFS module vfs_fruit allows code execution
>==
>== CVE ID#:     CVE-2021-44142
>==
>== Versions:    All versions of Samba priors to 4.13.17
>==
>== Summary:     This vulnerability allows remote attackers to
>==              execute arbitrary code as root on affected Samba
>==              installations that use the VFS module vfs_fruit.
>=================================================================
>
>===========
>Description
>===========
>
>All versions of Samba prior to 4.13.17 are vulnerable to an
>out-of-bounds heap read write vulnerability that allows remote
>attackers to execute arbitrary code as root on affected Samba
>installations that use the VFS module vfs_fruit.
>
>Authentication as unprivileged user that has write access to a file's
>EAs is required to exploit this vulnerablity. The specific flaw exists
>within the parsing of EA metadata when opening files in smbd.
>
>==================
>Patch Availability
>==================
>
>Patches addressing both these issues have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba 4.13.17, 4.14.12 and 4.15.4 have been issued as
>security releases to correct the defect. Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
>
>Base score 9.9.
>
>==========
>Workaround
>==========
>
>As a workaround remove the "fruit" VFS module from the list of
>configured VFS objects in any "vfs objects" line in the Samba
>configuration smb.conf.
>
>=======
>Credits
>=======
>
>Originally reported by Orange Tsai from DEVCORE.
>
>Patches provided by Ralph BÃ¶hme of the Samba team.
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================

Flags:

jra: review-

Actions: View

Attachments on bug 14914: 17008 | 17084 | 17087 | 17088 | 17089 | 17090 | 17091 | 17092 | 17093 | 17094 | 17115 | 17116 | 17117 | 17119 | 17128