CVE-2023-4091

Publication date 10 October 2023

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

Read the notes from the security team

Status

Package Ubuntu Release Status
samba 25.04 plucky
Fixed 2:4.18.6+dfsg-1ubuntu2.1
24.10 oracular
Fixed 2:4.18.6+dfsg-1ubuntu2.1
24.04 LTS noble
Fixed 2:4.18.6+dfsg-1ubuntu2.1
23.10 mantic
Fixed 2:4.18.6+dfsg-1ubuntu2.1
23.04 lunar
Fixed 2:4.17.7+dfsg-1ubuntu2.3
22.04 LTS jammy
Fixed 2:4.15.13+dfsg-0ubuntu1.5
20.04 LTS focal
Fixed 2:4.15.13+dfsg-0ubuntu0.20.04.6
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty
Needs evaluation

Notes

mdeslaur

only vulnerable when using non-default configuraton: acl_xattr:ignore system acls = yes

Severity score breakdown

Parameter Value
Base score 6.5 · Medium
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Related Ubuntu Security Notices (USN)

Other references