This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-44141 →

DEBIAN-CVE-2021-44141

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an are...

Original description

The description as published by the source.

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 samba

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.16.0+dfsg-2"}]}]

Debian:13 samba

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.16.0+dfsg-2"}]}]

Debian:14 samba

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.16.0+dfsg-2"}]}]

References

advisory security-tracker.debian.org