CVE-2021-44141
개요
A vulnerability was found in Samba due to an insecure link following. By querying a symlink inside the exported share using SMB1 with unix extensions turned on, an attacker can discover if a named or directory exists on the filesystem outside the exported share. This flaw allows a remote authenticated attacker to obtain sensitive information.
완화 방법
Do not enable SMB1 (please note SMB1 is disabled by default in Samba from version 4.11.0 and onwards). This prevents the creation or querying of symbolic links via SMB1. If SMB1 must be enabled for backwards compatibility then add the parameter:
unix extensions = noto the [global] section of your smb.conf and restart smbd. This prevents SMB1 clients from creating or reading symlinks on the exported file system.
However, if the same region of the file system is also exported allowing write access via NFS, NFS clients can create symlinks that allow SMB1 with unix extensions clients to discover the existance of the NFS created symlink targets. For non-patched versions of Samba we recommend only exporting areas of the file system by either SMB2 or NFS, not both.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 6.5 | 4.3 | N/A |
| 공격 벡터 | Network | Network | N/A |
| 공격 복잡성 | Low | Low | N/A |
| 필요한 권한 | Low | Low | N/A |
| 사용자 상호 작용 | None | None | N/A |
| 범위 | Unchanged | Unchanged | N/A |
| 기밀성 | High | Low | N/A |
| 무결성에 미치는 영향 | None | None | N/A |
| 가용성에 미치는 영향 | None | None | N/A |
벡터
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
취약점 이해 (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
감사의 말
Red Hat would like to thank Stefan Behrens for reporting this issue. Upstream acknowledges the Samba project as the original reporter.
