CVE-2021-44141

NameCVE-2021-44141
DescriptionAll versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1004692

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
samba (PTS)jessie, jessie (lts)2:4.2.14+dfsg-0+deb8u16vulnerable
stretch (security)2:4.5.16+dfsg-1+deb9u4vulnerable
stretch (lts), stretch2:4.5.16+dfsg-1+deb9u5vulnerable
buster (security), buster, buster (lts)2:4.9.5+dfsg-5+deb10u5vulnerable
bullseye (security), bullseye2:4.13.13+dfsg-1~deb11u6vulnerable
bookworm (security), bookworm2:4.17.12+dfsg-0+deb12u1fixed
trixie2:4.21.2+dfsg-3fixed
sid2:4.21.2+dfsg-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sambasourceexperimental2:4.16.0+dfsg-1
sambasource(unstable)2:4.16.0+dfsg-21004692

Notes

[bullseye] - samba <ignored> (Minor issue; no backport to older versions, mitigations exists)
[buster] - samba <ignored> (Minor issue; no backport to older versions, mitigations exists)
https://www.samba.org/samba/security/CVE-2021-44141.html
https://bugzilla.samba.org/show_bug.cgi?id=14911
[stretch] - samba <ignored> (Minor issue; no backport to older versions, mitigations exists)
[jessie] - samba <ignored> (Minor issue; no backport to older versions, mitigations exists)

Search for package or bug name: Reporting problems