CVE-2023-3961

CVE	CVE-2023-3961
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-11-03 13:15:00 UTC
Updated	2024-01-02 21:15:00 UTC
Description	A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.

Problem Types: CWE-22

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Fedoraproject	Fedora	39	All	All	All
Operating System	Redhat	Enterprise Linux	8.0	All	All	All
Operating System	Redhat	Enterprise Linux Eus	9.0	All	All	All
Application	Redhat	Storage	3.0	All	All	All
Application	Samba	Samba	All	All	All	All

Reference	Source	Link	Tags
2241881 – (CVE-2023-3961) CVE-2023-3961 samba: smbd allows client access to unix domain sockets on the file system as root	MISC	bugzilla.redhat.com
RHSA-2023:7464		access.redhat.com
security.netapp.com/advisory/ntap-20231124-0002		security.netapp.com
15422 – (CVE-2023-3961) CVE-2023-3961 [SECURITY] Unsanitized client pipe name passed to local_np_connect()	MISC	bugzilla.samba.org
RHSA-2023:7371		access.redhat.com
Samba - Security Announcement Archive	MISC	www.samba.org
[SECURITY] Fedora 39 Update: samba-4.19.2-1.fc39 - package-announce - Fedora Mailing-Lists	MISC	lists.fedoraproject.org
Red Hat	MISC	access.redhat.com
Red Hat		access.redhat.com
RHSA-2023:7408		access.redhat.com
RHSA-2023:7467		access.redhat.com
cve-details	MISC	access.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

161070 Oracle Enterprise Linux Security Update for samba (ELSA-2023-6744)
161196 Oracle Enterprise Linux Security Update for samba (ELSA-2023-7467)
242260 Red Hat Update for samba (RHSA-2023:6209)
242318 Red Hat Update for samba (RHSA-2023:6744)
242484 Red Hat Update for samba (RHSA-2023:7408)
242507 Red Hat Update for samba (RHSA-2023:7467)
242508 Red Hat Update for samba (RHSA-2023:7464)
284612 Fedora Security Update for samba (FEDORA-2023-7eb8cbf1a5)
284682 Fedora Security Update for samba (FEDORA-2023-fff0c857d6)
285191 Fedora Security Update for samba (FEDORA-2023-8c9251e479)
356630 Amazon Linux Security Advisory for samba : ALAS2023-2023-416
503395 Alpine Linux Security Update for samba
505937 Alpine Linux Security Update for samba
6000310 Debian Security Update for samba (DSA 5525-1)
710873 Gentoo Linux Samba Multiple Vulnerabilities (GLSA 202402-28)
755069 SUSE Enterprise Linux Security Update for samba (SUSE-SU-2023:4046-1)
941395 AlmaLinux Security Update for samba (ALSA-2023:6744)
941422 AlmaLinux Security Update for samba (ALSA-2023:7467)