Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that     connects to a running smbserver instance can list and write to arbitrary files via ../ directory     traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow     or an SSH authorized key. (CVE-2021-31800)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b692a49c-9ae7-4958-af21-cbf8f5b819ea advisory.

  - Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that     connects to a running smbserver instance can list and write to arbitrary files via ../ directory     traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow     or an SSH authorized key. (CVE-2021-31800)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257204	Linux Distros Unpatched Vulnerability : CVE-2021-31800	Nessus	Misc.	critical
174294	FreeBSD : py-impacket -- multiple path traversal vulnerabilities (b692a49c-9ae7-4958-af21-cbf8f5b819ea)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2021-31800

critical

Tenable Plugins

critical

critical