Bug 1763137 (CVE-2019-10218) - CVE-2019-10218 samba: smb client vulnerable to filenames containing path separators
Summary: CVE-2019-10218 samba: smb client vulnerable to filenames containing path sepa...
Alias: CVE-2019-10218
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1764468 1764469 1764471 1766558
Blocks: 1763144
TreeView+ depends on / blocked
Reported: 2019-10-18 10:26 UTC by Siddharth Sharma
Modified: 2023-09-07 20:49 UTC (History)
25 users (show)

Fixed In Version: samba 4.9.15, samba 4.10.10, samba 4.11.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the samba client where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.
Clone Of:
Last Closed: 2020-03-23 16:31:53 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:0943 0 None None None 2020-03-23 13:53:59 UTC
Red Hat Product Errata RHSA-2020:1084 0 None None None 2020-03-31 19:21:34 UTC
Red Hat Product Errata RHSA-2020:1878 0 None None None 2020-04-28 16:03:07 UTC

Description Siddharth Sharma 2019-10-18 10:26:45 UTC
As per upstream advisory:

Samba client code (libsmbclient) returns server-supplied filenames to calling code without checking for pathname separators (such as "/" or "../") in the server returned names.

A malicious server can craft a pathname containing separators and return this to client code, causing the client to use this access local pathnames for reading or writing instead of SMB network pathnames.

This access is done using the local privileges of the client.  

This attack can be achieved using any of SMB1/2/3 as it is not reliant on any specific SMB protocol version.

Specifically, samba client tools like smbget and smbclient's mget use the server supplied 'final' name component as a local name when obtaining multiple files.  While the design of these tools is that server can always choose the file names, this vulnerability is that it allows a remote server to create local files outside the current working directory.

Users of the libsmbclient library external to Samba may also be vulnerable if they use server returned filenames without adequate checking and pass them to functions that do local filesystem access.

Note that the Gnome GVFS client library is not believed to be vulnerable, as it always passes server-returned pathnames back to the SMB share they were returned from. Such malformed pathnames are then rejected by the server.

Upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=14071

Comment 5 Huzaifa S. Sidhpurwala 2019-10-23 11:30:27 UTC

Name: the Samba project
Upstream: Michael Hanselmann

Comment 6 Siddharth Sharma 2019-10-29 11:36:29 UTC
External References:


Comment 7 Siddharth Sharma 2019-10-29 11:36:51 UTC
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1766558]

Comment 11 errata-xmlrpc 2020-03-23 13:53:57 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.5 for RHEL 7

Via RHSA-2020:0943 https://access.redhat.com/errata/RHSA-2020:0943

Comment 12 Product Security DevOps Team 2020-03-23 16:31:53 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 13 errata-xmlrpc 2020-03-31 19:21:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1084 https://access.redhat.com/errata/RHSA-2020:1084

Comment 14 errata-xmlrpc 2020-04-28 16:03:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1878 https://access.redhat.com/errata/RHSA-2020:1878

Note You need to log in before you can comment on or make changes to this bug.