Bug 562568 (CVE-2010-0926)

Security researcher called "Kingcope" pointed out:

  [1] http://seclists.org/fulldisclosure/2010/Feb/82
  [2] http://www.youtube.com/watch?v=NN50RtZ2N74

and detailed:

  [3] http://seclists.org/fulldisclosure/2010/Feb/99

a deficiency in the behaviour of Samba server, providing
SMB/CIFS services to the clients.

Samba server, in the default configuration, is shipped
with configuration file parameter "wide links" set to
"yes" ("wide links = yes"). If a local user would first
locally create a symbolic link, which target would point
to some system sensitive file / directory and link name
of this link would be placed into an exported Samba share,
with write access for Samba users, this might allow a remote
attacker to read, list and retrieve files, behind the target
of the symbolic link.

Samba upstream review of reasons and impact of this issue:

  [4] http://marc.info/?l=samba-technical&m=126539387432412&w=2

As mentioned in [4] the problem "is actually a default insecure
configuration in Samba." and "comes from a combination of two 
features in Samba, each of which on their own are useful to
Administrators". 

Workaround -- to prevent occurrence of this deficiency set:
===========================================================

wide links = no

in the [global] section of your smb.conf and restart the
Samba (smbd) daemon. This will ensure, remote Samba clients
will not follow symbolink links, exported in Samba shares,
to their target anymore (thus prevent the potential disclosure
of sensitive data).