CVE-2010-0926

Samba <3.3.11, <3.4.6, <3.5.0rc3 - Path Traversal

Title source: llm

Description

The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.

Exploits (3)

exploitdb WORKING POC VERIFIED
by kingcope · rubyremotelinux
https://www.exploit-db.com/exploits/33598
exploitdb WORKING POC VERIFIED
by kingcope · textremotelinux
https://www.exploit-db.com/exploits/33599
metasploit WORKING POC
by kcope, hdm · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/smb/samba_symlink_traversal.rb

References (35)

... and 15 more

Scores

EPSS 0.5241
EPSS Percentile 97.9%

Details

CWE
CWE-22
Status published
Products (18)
samba/samba 3.3.0
samba/samba 3.3.1
samba/samba 3.3.2
samba/samba 3.3.3
samba/samba 3.3.4
samba/samba 3.3.5
samba/samba 3.3.6
samba/samba 3.3.7
samba/samba 3.3.8
samba/samba 3.3.9
... and 8 more
Published Mar 10, 2010
Tracked Since Feb 18, 2026