Red Hat Bugzilla – Bug 562568
CVE-2010-0926 samba: insecure "wide links" default
Last modified: 2015-08-19 04:43:44 EDT
Security researcher called "Kingcope" pointed out:
a deficiency in the behaviour of Samba server, providing
SMB/CIFS services to the clients.
Samba server, in the default configuration, is shipped
with configuration file parameter "wide links" set to
"yes" ("wide links = yes"). If a local user would first
locally create a symbolic link, which target would point
to some system sensitive file / directory and link name
of this link would be placed into an exported Samba share,
with write access for Samba users, this might allow a remote
attacker to read, list and retrieve files, behind the target
of the symbolic link.
Samba upstream review of reasons and impact of this issue:
As mentioned in  the problem "is actually a default insecure
configuration in Samba." and "comes from a combination of two
features in Samba, each of which on their own are useful to
Workaround -- to prevent occurrence of this deficiency set:
wide links = no
in the [global] section of your smb.conf and restart the
Samba (smbd) daemon. This will ensure, remote Samba clients
will not follow symbolink links, exported in Samba shares,
to their target anymore (thus prevent the potential disclosure
of sensitive data).
Link to public Metasploit module:
Upstream bug report and patch to make sure "wide links" and "unix extensions" can not both be enabled on one share:
This has been assigned CVE-2010-0926.
This issue was addressed in Samba packages in Red Hat Enterprise Linux 5. It did not affect Samba packages in Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this issue as having low security impact. There is no plan to address this flaw in Red Hat Enterprise Linux 4.
To prevent this issue, disable "wide links" or "unix extensions" in the Samba configuration file (/etc/samba/smb.conf) and restart smbd (service smb restart). Disabled "wide links" ensure that remote Samba clients will not have wide symbolic links (links pointing outside of the shared directory) resolved on the server side when processing requests from a client that does not support UNIX extensions. Disabled "unix extensions" prevents creation of wide links by malicious clients which support UNIX extensions. For further information, please view http://www.samba.org/samba/news/symlink_attack.html
This was corrected in upstream versions 3.4.6 and 3.5.0:
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2012:0313 https://rhn.redhat.com/errata/RHSA-2012-0313.html