#VU6630 Race condition in Samba - CVE-2017-2619

Vulnerability identifier: #VU6630

Vulnerability risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2017-2619

CWE-ID: CWE-362

Exploitation vector: Local network

Exploit availability: Yes

Vulnerable software:
Samba
Server applications / Directory software, identity management

Vendor: Samba

Description
The vulnerability allows a remote authenticated user to access otherwise restricted files.

The vulnerability exists due to a race condition when processing symlinks, which lead to files outside the shared folder. An attacker with ability to crate a symlink on a network share can access files not exported under the share definition.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive data, but requires that server is under heavy load.

Mitigation
The vulnerability is patched in versions 4.6.1, 4.5.7 and 4.4.12.

Vulnerable software versions

Samba: 4.4.0 rc4 - 4.4.11, 4.5.0 - 4.5.6, 4.6.0

---

External links
https://www.samba.org/samba/security/CVE-2017-2619.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.