CVE-2023-4091
Samba: smb clients can truncate files with read-only permissions
Summary
Samba: smb clients can truncate files with read-only permissions
Original description
The description as published by the source.
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-4091 samba Fixed in: 4.18.8-r0
- Debian DEBIAN-CVE-2023-4091 samba Fixed in: 2:4.13.13+dfsg-1~deb11u6
References
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- report bugzilla.redhat.com
- report bugzilla.samba.org
- web access.redhat.com
- web lists.debian.org
- web lists.fedoraproject.org
- web samba.org