According to its banner, the version of Samba is 3.3.x earlier than 3.3.11, or 3.4.x earlier than 3.4.6, or 3.5.x earlier than 3.5.0rc3, and is therefore affected by a directory-traversal vulnerability as the application fails to sufficiently sanitize user-supplied input.  According to the vendor, the issue stems from an insecure default configuration.  The vendor advises administrators to set 'wide links = no' in the '[global]' section of 'smb.conf'.  To exploit this issue, attackers require authenticated access to a writable share, and may be exploited through a writable share accessible by guest accounts.  This may allow an attacker to access files outside of the Samba user's root directory to obtain sensitive information and perform other attacks.

With enabled 'wide links' samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files (CVE-2010-0926). This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in smb.conf.

Due to a race condition in mount.cifs a local attacker could corrupt /etc/mtab if mount.cifs is installed setuid root. mount.cifs is not setuid root by default and it's not recommended to change that.
(CVE-2010-0547)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0313 advisory.

    - Security Release, fixes CVE-2010-0926
    - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694,       CVE-2011-2522, CVE-2011-1678, CVE-2011-2724
    - Security Release, fixes CVE-2011-0719
    - Security Release, fixes CVE-2010-3069

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3,     when a writable share exists, allows remote authenticated users to leverage a directory traversal     vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink     containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links     options. (CVE-2010-0926)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered the Samba handled symlinks in an unexpected way when both 'wide links' and 'UNIX extensions' were enabled, which is the default. A remote attacker could create symlinks and access arbitrary files from the server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

With enabled 'wide links' samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files (CVE-2010-0926). This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in smb.conf.

Due to a race condition in mount.cifs a local attacker could corrupt /etc/mtab if mount.cifs is installed setuid root. mount.cifs is not setuid root by default and it's not recommended to change that (CVE-2010-0547).

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-264:01 advisory.

    Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other     information (such as lists of available files and printers). The Windows NT, OS/2, and Linux operating     systems support this natively, and add-on packages can enable the same thing for DOS, Windows, VMS, UNIX     of all kinds, MVS, and more. This package provides an SMB server that can be used to provide network     services to SMB (sometimes called Lan Manager) clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols     and does NOT need the NetBEUI (Microsoft Raw NetBIOS frame) protocol.
    Security issues fixed with this release:
    CVE-2010-0926     The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3,     when a writable share exists, allows remote authenticated users to leverage a directory traversal     vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink     containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links     options.
    CVE-2012-0870     Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the     BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial     of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that     triggers infinite recursion.
    Fixed bugs:
     Because the smbclient sometimes failed to return the proper exit status code, using it in a script could     cause the script to fail. This has been fixed.
    Enhancement:
     Added support for Windows Server 2008 R2 domains.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Samba server is configured insecurely and allows a remote attacker to gain read or possibly write access to arbitrary files on the affected host.  Specifically, if an attacker has a valid Samba account for a share that is writable or there is a writable share that is configured to be a guest account share, he can create a symlink using directory traversal sequences and gain access to files and directories outside that share. 

Note that successful exploitation requires that the Samba server's 'wide links' parameter be set to 'yes', which is the default.

With enabled 'wide links' Samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files (CVE-2010-0926). This update changes the default setting to have 'wide links' disabled by default. The new default only works if 'wide links' is not set explicitly in smb.conf.

Due to a race condition in mount.cifs a local attacker could corrupt /etc/mtab if mount.cifs is installed setuid root. mount.cifs is not setuid root by default and it's not recommended to change that.
(CVE-2010-0547)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0313 advisory.

  - samba: insecure wide links default (CVE-2010-0926)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
9342	Samba 3.3.x < 3.3.11 / 3.4.x < 3.4.6 / 3.5.x < 3.5.0rc3 Directory Traversal	Nessus Network Monitor	Samba	6/9/2016	3/6/2019	medium
45453	SuSE9 Security Update : Samba (YOU Patch Number 12595)	Nessus	SuSE Local Security Checks	4/9/2010	1/14/2021	low
45471	SuSE 10 Security Update : Samba (ZYPP Patch Number 6920)	Nessus	SuSE Local Security Checks	4/9/2010	1/14/2021	low
68484	Oracle Linux 5 : samba (ELSA-2012-0313)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	high
217131	Linux Distros Unpatched Vulnerability : CVE-2010-0926	Nessus	Misc.	3/3/2025	1/28/2026	critical
45343	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : samba vulnerability (USN-918-1)	Nessus	Ubuntu Local Security Checks	3/25/2010	9/19/2019	low
45341	openSUSE Security Update : cifs-mount (cifs-mount-2128)	Nessus	SuSE Local Security Checks	3/25/2010	1/14/2021	low
283977	MiracleLinux 3 : samba-3.0.33-3.38.0.1.AXS3 (AXSA:2012-264:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	high
44406	Samba Symlink Traversal Arbitrary File Access (unsafe check)	Nessus	Misc.	2/8/2010	11/15/2018	high
45130	SuSE 11 Security Update : Samba (SAT Patch Number 2126)	Nessus	SuSE Local Security Checks	3/23/2010	1/14/2021	low
45339	openSUSE Security Update : cifs-mount (cifs-mount-2128)	Nessus	SuSE Local Security Checks	3/25/2010	1/14/2021	low
45340	openSUSE Security Update : cifs-mount (cifs-mount-2128)	Nessus	SuSE Local Security Checks	3/25/2010	1/14/2021	low
49834	SuSE 10 Security Update : Samba (ZYPP Patch Number 6921)	Nessus	SuSE Local Security Checks	10/11/2010	1/14/2021	low
58067	RHEL 5 : samba (RHSA-2012:0313)	Nessus	Red Hat Local Security Checks	2/21/2012	4/27/2024	high

Detections

Analytics

Plugins Search

medium

low

low

high

critical

low

low

high

high

low

low

low

low

high