--- title: "CVE-2010-0926\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2010-0926?format=md keywords: index, follow --- # CVE-2010-0926 Publication date 10 March 2010 Last updated 24 July 2024 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options. [Read the notes from the security team](https://ubuntu.com/security/CVE-2010-0926?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | samba | 9.10 karmic | Fixed 2:3.4.0-3ubuntu5.6 | | 9.04 jaunty | Fixed 2:3.3.2-1ubuntu3.4 | | 8.10 intrepid | Fixed 2:3.2.3-1ubuntu3.8 | | 8.04 LTS hardy | Fixed 3.0.28a-1ubuntu4.11 | | 6.06 LTS dapper | Fixed 3.0.22-1ubuntu3.11 | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2010-0926?format=md#patch-details) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) In a default samba configuration, both the unix extensions and the wide links options are on by default. Unix extensions gives extra capabilities to UNIX clients, including symlink support. If a client connects and uses UNIX capabilities, symlinks are sent as-is by the server and are handled by the client. If the client doesn't support UNIX extensions, the server will resolve the symlink and send the actual file it links to. Wide links tells the samba server to follow symlinks even if they point outside the shared directory. The combination of these two parameters can be exploited in the following way: - Unix client creates a new symlink to / - Windows client can then enter the directory pointed to by the symlink as it is followed server-side and read any file from the server's filesystem, if DAC permissions allow it. There is no simple way to fix this issue without possible breaking existing configurations. Leaving it unfixed results in server admins inadvertantly sharing the whole server filesystem. Fixing it results in breaking configurations where a samba share contains symlinks that point outside of the shared directory. The upstream patch changes samba behaviour in that the "wide links" option will get disabled automatically if "UNIX permissions" is enabled. A warning will be issued in the server's log file, which will help diagnose the problem PoC: http://blog.metasploit.com/2010/02/exploiting-samba-symlink-traversal.html ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | samba | * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: * Upstream: | ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0926) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2010-0926) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2010-0926) * [Debian](https://security-tracker.debian.org/tracker/CVE-2010-0926) ### Related Ubuntu Security Notices (USN) + [USN-918-1](https://usn.ubuntu.com/USN-918-1) + Samba vulnerability + 24 March 2010 ### Other references * * *