1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml">
6 <title>Samba - Security Announcement Archive</title>
11 <H2>CAN-2004-0815: Potential Arbitrary File Access in Samba 2.2.x <=2.2.11 and 3.0.x <= 3.0.2a</H2>
15 Subject: Potential Arbitrary File Access
18 Versions: Samba 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.2a
20 Summary: A remote attacker may be able to gain access
21 to files which exist outside of the share's
22 defined path. Such files must still be readable
23 by the account used for the connection.
28 The patch for Samba 3.0.2a and earlier releases 3.0.x
29 (samba-3.0.2a-reduce_name.patch) can be downloaded
30 from http://www.samba.org/samba/ftp/patches/security/
32 Samba 2.2.12 has been released to specifically address
39 A bug in the input validation routines used to convert DOS
40 path names to path names on the Samba host's file system
41 may be exploited to gain access to files outside of the
42 share's path defined by smb.conf.
45 Protecting Unpatched Servers
46 ----------------------------
48 Samba file shares with 'wide links = no' (a non-default setting)
49 in the service definition in smb.conf are *not* vulnerable to
52 The Samba Team always encourages users to run the latest stable
53 release as a defense of against attacks. However, under certain
54 circumstances it may not be possible to immediately upgrade
55 important installations. In such cases, administrators should
56 read the "Server Security" documentation found at
57 http://www.samba.org/samba/docs/server_security.html.
63 Both security issues were reported to Samba developers by
64 iDEFENSE (http://www.idefense.com/). Karol Wiesek is credited
69 Our Code, Our Bugs, Our Responsibility.