CVE-2021-43566

All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.

CVSS v3 2.5 LOW
CVSS v2.0 1.2 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

1.2^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 1.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://bugzilla.samba.org/show_bug.cgi?id=13979	Exploit Issue Tracking Vendor Advisory
https://security.netapp.com/advisory/ntap-20220110-0001/	Third Party Advisory
https://www.samba.org/samba/security/CVE-2021-43566.html	Patch Vendor Advisory
https://bugzilla.samba.org/show_bug.cgi?id=13979	Exploit Issue Tracking Vendor Advisory
https://security.netapp.com/advisory/ntap-20220110-0001/	Third Party Advisory
https://www.samba.org/samba/security/CVE-2021-43566.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-01-11 16:15

Updated : 2024-11-21 06:29

NVD link : CVE-2021-43566

Mitre link : CVE-2021-43566

CVE.ORG link : CVE-2021-43566

JSON object : View

Products Affected

samba

samba

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2021-43566", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 1.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}]}, "published": "2022-01-11T16:15:07.813", "references": [{"url": "https://bugzilla.samba.org/show_bug.cgi?id=13979", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20220110-0001/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.samba.org/samba/security/CVE-2021-43566.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.samba.org/show_bug.cgi?id=13979", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20220110-0001/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.samba.org/samba/security/CVE-2021-43566.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed."}, {"lang": "es", "value": "Todas las versiones de Samba anteriores a 4.13.16, son vulnerables a que un cliente malicioso use una carrera SMB1 o NFS para permitir la creaci\u00f3n de un directorio en un \u00e1rea del sistema de archivos del servidor no exportada bajo la definici\u00f3n del recurso compartido. Tenga en cuenta que SMB1 tiene que estar habilitado, o el recurso compartido tambi\u00e9n disponible por medio de NFS para que este ataque tenga \u00e9xito"}], "lastModified": "2024-11-21T06:29:27.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7CDF46B-0749-4D41-B5E9-A94CF1A5F083", "versionEndExcluding": "4.13.16"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}