NA

CVE-2023-4091

Published: 03/11/2023 Updated: 22/04/2024
CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8
VMScore: 0

Vulnerability Summary

A vulnerability exists in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

Vulnerable Product Search on Vulmon Subscribe to Product

samba samba

fedoraproject fedora 39

redhat enterprise linux 8.0

redhat storage 3.0

redhat enterprise linux eus 9.0

Vendor Advisories

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix, which might result in denial of service, information disclosure or privilege escalation For the stable distribution (bookworm), these problems have been fixed in version 2:41712+dfsg-0+deb12u1 We recommend that you upgrade your samba packag ...
Synopsis Moderate: samba security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for samba is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has rated this ...
概述 Important: OpenShift Container Platform 41245 bug fix and security update 类型/严重性 Security Advisory: Important 标题 Red Hat OpenShift Container Platform release 41245 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShi ...
Synopsis Moderate: samba security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for samba is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a securi ...
概要 Important: OpenShift Container Platform 41324 bug fix and security update タイプ/重大度 Security Advisory: Important トピック Red Hat OpenShift Container Platform release 41324 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Ha ...
Synopsis Important: OpenShift Container Platform 41154 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41154 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Moderate: samba security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for samba is now available for Red Hat Enterprise Linux 88 Extended Update SupportRed Hat Product Security has rated this ...
Synopsis Important: OpenShift Container Platform 4144 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4144 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift C ...
Synopsis Moderate: samba security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for samba is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having a securi ...
When doing NTLM authentication, the client sends replies tocryptographic challenges back to the server These replieshave variable length Winbind did not properly bounds-checkthe lan manager response length, which despite the lanmanager version no longer being used is still part of theprotocol If the system is running Samba's ntlm_auth as authent ...
When doing NTLM authentication, the client sends replies tocryptographic challenges back to the server These replieshave variable length Winbind did not properly bounds-checkthe lan manager response length, which despite the lanmanager version no longer being used is still part of theprotocol If the system is running Samba's ntlm_auth as authent ...