Path Traversal Vulnerability in Samba Client: CVE-2019-10218
Summary
ALPINE-CVE-2019-10218: A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. Affects samba versions < 4.10.10-r0. Fixed in 4.10.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Samba is an open-source software suite that provides seamless file and print services to SMB/CIFS clients. It enables interoperability between Linux/Unix servers and Windows-based clients. The Samba client is responsible for accessing shared files and directories on remote servers. This vulnerability affects multiple versions of Samba, allowing malicious servers to exploit the client.
Vulnerability Detail
A flaw was found in the Samba client, affecting all versions before Samba 4.11.2, 4.10.10, and 4.9.15. A malicious server can supply a pathname with separators, enabling the client to access files and folders outside of the intended SMB network pathnames. This could allow an attacker to create files outside the current working directory using the privileges of the client user, posing a significant security risk.
How To Fix
Minimum fixed version
4.10.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid connecting to untrusted or malicious Samba servers until the package can be updated. Ensure that your Samba client is configured to restrict access to known and trusted servers only.
Conclusion
CVE-2019-10218 is a significant vulnerability in the Samba client that can lead to unauthorized file access. It is crucial to update to the patched versions to safeguard against potential exploits. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for samba →
FAQ
CVE-2019-10218 is a vulnerability in the Samba client that allows a malicious server to exploit pathname handling, potentially leading to unauthorized file access.
All Samba versions before 4.11.2, 4.10.10, and 4.9.15 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2019-10218 is 6.5, indicating a medium severity level.
If you cannot update Samba immediately, ensure that you only connect to trusted Samba servers and consider implementing additional security measures to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for samba.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
