Sign-up

ID

VAR-202201-0295


CVE

CVE-2021-44142


TITLE

Samba vfs_fruit module insecurely handles extended file attributes

Trust: 0.8

sources: CERT/CC: VU#119678

DESCRIPTION

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of AppleDouble entries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. The specific flaw exists within the parsing of EA metadata when opening files in smbd. The problem in vfs_fruit exists in the default configuration of the fruit VFS module using fruit:metadata=netatalk or fruit:resource=file. If both options are set to different settings than the default values, the system is not affected by the security issue. ================== Patch Availability ================== Patches addressing both these issues have been posted to: https://www.samba.org/samba/security/ Additionally, Samba 4.13.17, 4.14.12 and 4.15.5 have been issued as security releases to correct the defect. Samba administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C Base score 9.9. ========== Workaround ========== As a workaround remove the "fruit" VFS module from the list of configured VFS objects in any "vfs objects" line in the Samba configuration smb.conf. Note that changing the VFS module settings fruit:metadata or fruit:resource to use the unaffected setting causes all stored information to be inaccessible and will make it appear to macOS clients as if the information is lost. ======= Credits ======= Originally reported by Orange Tsai from DEVCORE. Patches provided by Ralph Böhme of the Samba team. ========================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ========================================================== . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Critical: samba security update Advisory ID: RHSA-2022:0664-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:0664 Issue date: 2022-02-23 CVE Names: CVE-2021-44142 ==================================================================== 1. Summary: An update for samba is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support, Red Hat Enterprise Linux 7.7 Telco Extended Update Support, and Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.7) - noarch, x86_64 Red Hat Enterprise Linux Server E4S (v. 7.7) - noarch, ppc64le, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 7.7) - noarch, x86_64 Red Hat Enterprise Linux Server Optional E4S (v. 7.6) - noarch, ppc64le, x86_64 Red Hat Enterprise Linux Server Optional TUS (v. 7.7) - noarch, x86_64 Red Hat Enterprise Linux Server TUS (v. 7.7) - noarch, x86_64 3. Description: Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution (CVE-2021-44142) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the smb service will be restarted automatically. 5. Package List: Red Hat Enterprise Linux Server AUS (v. 7.7): Source: samba-4.9.1-12.el7_7.src.rpm noarch: samba-common-4.9.1-12.el7_7.noarch.rpm x86_64: libsmbclient-4.9.1-12.el7_7.i686.rpm libsmbclient-4.9.1-12.el7_7.x86_64.rpm libwbclient-4.9.1-12.el7_7.i686.rpm libwbclient-4.9.1-12.el7_7.x86_64.rpm samba-4.9.1-12.el7_7.x86_64.rpm samba-client-4.9.1-12.el7_7.x86_64.rpm samba-client-libs-4.9.1-12.el7_7.i686.rpm samba-client-libs-4.9.1-12.el7_7.x86_64.rpm samba-common-libs-4.9.1-12.el7_7.x86_64.rpm samba-common-tools-4.9.1-12.el7_7.x86_64.rpm samba-debuginfo-4.9.1-12.el7_7.i686.rpm samba-debuginfo-4.9.1-12.el7_7.x86_64.rpm samba-krb5-printing-4.9.1-12.el7_7.x86_64.rpm samba-libs-4.9.1-12.el7_7.i686.rpm samba-libs-4.9.1-12.el7_7.x86_64.rpm samba-python-4.9.1-12.el7_7.i686.rpm samba-python-4.9.1-12.el7_7.x86_64.rpm samba-winbind-4.9.1-12.el7_7.x86_64.rpm samba-winbind-clients-4.9.1-12.el7_7.x86_64.rpm samba-winbind-modules-4.9.1-12.el7_7.i686.rpm samba-winbind-modules-4.9.1-12.el7_7.x86_64.rpm Red Hat Enterprise Linux Server E4S (v. 7.7): Source: samba-4.9.1-12.el7_7.src.rpm noarch: samba-common-4.9.1-12.el7_7.noarch.rpm ppc64le: libsmbclient-4.9.1-12.el7_7.ppc64le.rpm libwbclient-4.9.1-12.el7_7.ppc64le.rpm samba-4.9.1-12.el7_7.ppc64le.rpm samba-client-4.9.1-12.el7_7.ppc64le.rpm samba-client-libs-4.9.1-12.el7_7.ppc64le.rpm samba-common-libs-4.9.1-12.el7_7.ppc64le.rpm samba-common-tools-4.9.1-12.el7_7.ppc64le.rpm samba-debuginfo-4.9.1-12.el7_7.ppc64le.rpm samba-krb5-printing-4.9.1-12.el7_7.ppc64le.rpm samba-libs-4.9.1-12.el7_7.ppc64le.rpm samba-winbind-4.9.1-12.el7_7.ppc64le.rpm samba-winbind-clients-4.9.1-12.el7_7.ppc64le.rpm samba-winbind-modules-4.9.1-12.el7_7.ppc64le.rpm x86_64: libsmbclient-4.9.1-12.el7_7.i686.rpm libsmbclient-4.9.1-12.el7_7.x86_64.rpm libwbclient-4.9.1-12.el7_7.i686.rpm libwbclient-4.9.1-12.el7_7.x86_64.rpm samba-4.9.1-12.el7_7.x86_64.rpm samba-client-4.9.1-12.el7_7.x86_64.rpm samba-client-libs-4.9.1-12.el7_7.i686.rpm samba-client-libs-4.9.1-12.el7_7.x86_64.rpm samba-common-libs-4.9.1-12.el7_7.x86_64.rpm samba-common-tools-4.9.1-12.el7_7.x86_64.rpm samba-debuginfo-4.9.1-12.el7_7.i686.rpm samba-debuginfo-4.9.1-12.el7_7.x86_64.rpm samba-krb5-printing-4.9.1-12.el7_7.x86_64.rpm samba-libs-4.9.1-12.el7_7.i686.rpm samba-libs-4.9.1-12.el7_7.x86_64.rpm samba-python-4.9.1-12.el7_7.i686.rpm samba-python-4.9.1-12.el7_7.x86_64.rpm samba-winbind-4.9.1-12.el7_7.x86_64.rpm samba-winbind-clients-4.9.1-12.el7_7.x86_64.rpm samba-winbind-modules-4.9.1-12.el7_7.i686.rpm samba-winbind-modules-4.9.1-12.el7_7.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 7.7): Source: samba-4.9.1-12.el7_7.src.rpm noarch: samba-common-4.9.1-12.el7_7.noarch.rpm x86_64: libsmbclient-4.9.1-12.el7_7.i686.rpm libsmbclient-4.9.1-12.el7_7.x86_64.rpm libwbclient-4.9.1-12.el7_7.i686.rpm libwbclient-4.9.1-12.el7_7.x86_64.rpm samba-4.9.1-12.el7_7.x86_64.rpm samba-client-4.9.1-12.el7_7.x86_64.rpm samba-client-libs-4.9.1-12.el7_7.i686.rpm samba-client-libs-4.9.1-12.el7_7.x86_64.rpm samba-common-libs-4.9.1-12.el7_7.x86_64.rpm samba-common-tools-4.9.1-12.el7_7.x86_64.rpm samba-debuginfo-4.9.1-12.el7_7.i686.rpm samba-debuginfo-4.9.1-12.el7_7.x86_64.rpm samba-krb5-printing-4.9.1-12.el7_7.x86_64.rpm samba-libs-4.9.1-12.el7_7.i686.rpm samba-libs-4.9.1-12.el7_7.x86_64.rpm samba-python-4.9.1-12.el7_7.i686.rpm samba-python-4.9.1-12.el7_7.x86_64.rpm samba-winbind-4.9.1-12.el7_7.x86_64.rpm samba-winbind-clients-4.9.1-12.el7_7.x86_64.rpm samba-winbind-modules-4.9.1-12.el7_7.i686.rpm samba-winbind-modules-4.9.1-12.el7_7.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 7.7): noarch: samba-pidl-4.9.1-12.el7_7.noarch.rpm x86_64: libsmbclient-devel-4.9.1-12.el7_7.i686.rpm libsmbclient-devel-4.9.1-12.el7_7.x86_64.rpm libwbclient-devel-4.9.1-12.el7_7.i686.rpm libwbclient-devel-4.9.1-12.el7_7.x86_64.rpm samba-dc-4.9.1-12.el7_7.x86_64.rpm samba-dc-libs-4.9.1-12.el7_7.x86_64.rpm samba-debuginfo-4.9.1-12.el7_7.i686.rpm samba-debuginfo-4.9.1-12.el7_7.x86_64.rpm samba-devel-4.9.1-12.el7_7.i686.rpm samba-devel-4.9.1-12.el7_7.x86_64.rpm samba-python-test-4.9.1-12.el7_7.x86_64.rpm samba-test-4.9.1-12.el7_7.x86_64.rpm samba-test-libs-4.9.1-12.el7_7.i686.rpm samba-test-libs-4.9.1-12.el7_7.x86_64.rpm samba-vfs-glusterfs-4.9.1-12.el7_7.x86_64.rpm samba-winbind-krb5-locator-4.9.1-12.el7_7.x86_64.rpm Red Hat Enterprise Linux Server Optional E4S (v. 7.6): noarch: samba-pidl-4.9.1-12.el7_7.noarch.rpm ppc64le: libsmbclient-devel-4.9.1-12.el7_7.ppc64le.rpm libwbclient-devel-4.9.1-12.el7_7.ppc64le.rpm samba-dc-4.9.1-12.el7_7.ppc64le.rpm samba-dc-libs-4.9.1-12.el7_7.ppc64le.rpm samba-debuginfo-4.9.1-12.el7_7.ppc64le.rpm samba-devel-4.9.1-12.el7_7.ppc64le.rpm samba-python-4.9.1-12.el7_7.ppc64le.rpm samba-python-test-4.9.1-12.el7_7.ppc64le.rpm samba-test-4.9.1-12.el7_7.ppc64le.rpm samba-test-libs-4.9.1-12.el7_7.ppc64le.rpm samba-winbind-krb5-locator-4.9.1-12.el7_7.ppc64le.rpm x86_64: libsmbclient-devel-4.9.1-12.el7_7.i686.rpm libsmbclient-devel-4.9.1-12.el7_7.x86_64.rpm libwbclient-devel-4.9.1-12.el7_7.i686.rpm libwbclient-devel-4.9.1-12.el7_7.x86_64.rpm samba-dc-4.9.1-12.el7_7.x86_64.rpm samba-dc-libs-4.9.1-12.el7_7.x86_64.rpm samba-debuginfo-4.9.1-12.el7_7.i686.rpm samba-debuginfo-4.9.1-12.el7_7.x86_64.rpm samba-devel-4.9.1-12.el7_7.i686.rpm samba-devel-4.9.1-12.el7_7.x86_64.rpm samba-python-test-4.9.1-12.el7_7.x86_64.rpm samba-test-4.9.1-12.el7_7.x86_64.rpm samba-test-libs-4.9.1-12.el7_7.i686.rpm samba-test-libs-4.9.1-12.el7_7.x86_64.rpm samba-vfs-glusterfs-4.9.1-12.el7_7.x86_64.rpm samba-winbind-krb5-locator-4.9.1-12.el7_7.x86_64.rpm Red Hat Enterprise Linux Server Optional TUS (v. 7.7): noarch: samba-pidl-4.9.1-12.el7_7.noarch.rpm x86_64: libsmbclient-devel-4.9.1-12.el7_7.i686.rpm libsmbclient-devel-4.9.1-12.el7_7.x86_64.rpm libwbclient-devel-4.9.1-12.el7_7.i686.rpm libwbclient-devel-4.9.1-12.el7_7.x86_64.rpm samba-dc-4.9.1-12.el7_7.x86_64.rpm samba-dc-libs-4.9.1-12.el7_7.x86_64.rpm samba-debuginfo-4.9.1-12.el7_7.i686.rpm samba-debuginfo-4.9.1-12.el7_7.x86_64.rpm samba-devel-4.9.1-12.el7_7.i686.rpm samba-devel-4.9.1-12.el7_7.x86_64.rpm samba-python-test-4.9.1-12.el7_7.x86_64.rpm samba-test-4.9.1-12.el7_7.x86_64.rpm samba-test-libs-4.9.1-12.el7_7.i686.rpm samba-test-libs-4.9.1-12.el7_7.x86_64.rpm samba-vfs-glusterfs-4.9.1-12.el7_7.x86_64.rpm samba-winbind-krb5-locator-4.9.1-12.el7_7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-44142 https://access.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYhaxfdzjgjWX9erEAQgiRA/+OW3s71s6N96G2iZh1w2A+AJhuPR9g/R9 xQ42N7OxSjqyXuGBEa75FNSg+ynFxWKaCCMs4WKT18gTw5njQJNzGAcdZ+czZBzd M3gHIbUH/KJ2OlwwGGaGvXQJfEYaQPEeqFsuvkNUYEr9fBPshjl8fNNZwqV8FIqm mQMt8PcHIfLVgbKASIc+qNEZS7ql97w3U1sYAHjwhtPNAYNlbW/jjRNrnILhgHoj Io1zIpN+qa4wZ40H3SCpGd6sC7RVqZps7nt4l73mLBewuWzJItLHTFfjI51NsNK+ 0j4VxTAwaLlh98+4R9ddbMAcySLlm9Vua3N44nFmnEZIP+ugwvJIL201l2yfxEV4 VKO0exmDqtIOBk7fuN0A+Oj9qJHxnWAAQF993jSpFt57aW9T8m+Uh6AXO2Gv7+eu 8kBd69TWwnUjHh6KbxVMV2aM675B+zLxuI1gKlAKs3DRCQf0IfKDPAuHz1qST2LM 4bT7gYV8SixAz69mGSvWyd0CP9nKYBu5iXkwaHut6BdwegUHqn5au0zmTIoU+mfi lyQ2x1q0fB3kw5Z0fKw7ZNwpBkw/B133fKcb4qLUbJZg9sxXEY3XZH/wm2Bi2U8+ Lz7XCoeJCnH8I/P9WbxSX3EZir8Z0qoNTsdFxYpVsjhQ82pbqGHRBjIWG4iXzTCi /LuSuXQFenk=EUCP -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bug Fix(es): * Fix username map script regression introduced with CVE-2020-25717 (BZ#2046173) 4

Trust: 4.68

sources: NVD: CVE-2021-44142 // CERT/CC: VU#119678 // JVNDB: JVNDB-2022-001296 // ZDI: ZDI-22-246 // ZDI: ZDI-22-245 // ZDI: ZDI-22-244 // VULHUB: VHN-406753 // VULMON: CVE-2021-44142 // PACKETSTORM: 165801 // PACKETSTORM: 166137 // PACKETSTORM: 165793

AFFECTED PRODUCTS

vendor:sambamodel:sambascope: - version: -

Trust: 2.1

vendor:redhatmodel:enterprise linux workstationscope:eqversion:7.0

Trust: 1.0

vendor:redhatmodel:gluster storagescope:eqversion:3.5

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:8.4

Trust: 1.0

vendor:redhatmodel:enterprise linux resilient storagescope:eqversion:7.0

Trust: 1.0

vendor:redhatmodel:enterprise linux for ibm z systemsscope:eqversion:7.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server update services for sap solutionsscope:eqversion:8.1

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:21.10

Trust: 1.0

vendor:redhatmodel:enterprise linux server update services for sap solutionsscope:eqversion:8.4

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:16.04

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.04

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:34

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:35

Trust: 1.0

vendor:redhatmodel:enterprise linux for power little endian eusscope:eqversion:8.2

Trust: 1.0

vendor:redhatmodel:enterprise linuxscope:eqversion:7.0

Trust: 1.0

vendor:synologymodel:diskstation managerscope:ltversion:6.2.4-25556.4

Trust: 1.0

vendor:redhatmodel:enterprise linux for power big endianscope:eqversion:7.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:8.4

Trust: 1.0

vendor:redhatmodel:enterprise linux desktopscope:eqversion:7.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:8.4

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:8.1

Trust: 1.0

vendor:redhatmodel:virtualization hostscope:eqversion:4.0

Trust: 1.0

vendor:redhatmodel:enterprise linux for ibm z systems eusscope:eqversion:8.2

Trust: 1.0

vendor:redhatmodel:enterprise linux for power little endianscope:eqversion:7.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:20.04

Trust: 1.0

vendor:redhatmodel:enterprise linux for ibm z systemsscope:eqversion:8.0

Trust: 1.0

vendor:redhatmodel:codeready linux builderscope:eqversion: -

Trust: 1.0

vendor:redhatmodel:enterprise linux for power little endian eusscope:eqversion:8.4

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:8.2

Trust: 1.0

vendor:sambamodel:sambascope:ltversion:4.15.5

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:redhatmodel:enterprise linuxscope:eqversion:8.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server update services for sap solutionsscope:eqversion:8.2

Trust: 1.0

vendor:synologymodel:diskstation managerscope:gteversion:6.2

Trust: 1.0

vendor:redhatmodel:enterprise linux for scientific computingscope:eqversion:7.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:18.04

Trust: 1.0

vendor:sambamodel:sambascope:gteversion:4.14.0

Trust: 1.0

vendor:redhatmodel:enterprise linux for ibm z systems eusscope:eqversion:8.4

Trust: 1.0

vendor:sambamodel:sambascope:gteversion:4.15.0

Trust: 1.0

vendor:sambamodel:sambascope:ltversion:4.13.17

Trust: 1.0

vendor:redhatmodel:enterprise linux for power little endianscope:eqversion:8.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:8.2

Trust: 1.0

vendor:sambamodel:sambascope:ltversion:4.14.12

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:8.2

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:7.0

Trust: 1.0

vendor:sambamodel:sambascope:ltversion:4.13.17 earlier s

Trust: 0.8

vendor:sambamodel:sambascope:eqversion: -

Trust: 0.8

sources: ZDI: ZDI-22-246 // ZDI: ZDI-22-245 // ZDI: ZDI-22-244 // JVNDB: JVNDB-2022-001296 // NVD: CVE-2021-44142

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: CVE-2021-44142
value: CRITICAL

Trust: 1.4

nvd@nist.gov: CVE-2021-44142
value: HIGH

Trust: 1.0

OTHER: JVNDB-2022-001296
value: CRITICAL

Trust: 0.8

ZDI: CVE-2021-44142
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-202201-2719
value: HIGH

Trust: 0.6

VULHUB: VHN-406753
value: HIGH

Trust: 0.1

VULMON: CVE-2021-44142
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-44142
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-406753
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

ZDI: CVE-2021-44142
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.4

nvd@nist.gov: CVE-2021-44142
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2022-001296
baseSeverity: CRITICAL
baseScore: 9.9
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2021-44142
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-246 // ZDI: ZDI-22-245 // ZDI: ZDI-22-244 // VULHUB: VHN-406753 // VULMON: CVE-2021-44142 // JVNDB: JVNDB-2022-001296 // CNNVD: CNNVD-202201-2719 // NVD: CVE-2021-44142

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.1

problemtype:CWE-787

Trust: 1.1

sources: VULHUB: VHN-406753 // NVD: CVE-2021-44142

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 165801 // CNNVD: CNNVD-202201-2719

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202201-2719

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-406753

PATCH
title:Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution The Samba-Bugzillaurl:https://www.samba.org/samba/security/CVE-2021-44142.html
Trust: 2.9
title:Samba Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=184448
Trust: 0.6
title:Red Hat: Critical: samba security and bug fix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220332 - Security Advisory
Trust: 0.1
title:Ubuntu Security Notice: USN-5260-2: Samba vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-5260-2
Trust: 0.1
title:Red Hat: Critical: samba security and bug fix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220331 - Security Advisory
Trust: 0.1
title:Ubuntu Security Notice: USN-5260-3: Samba vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-5260-3
Trust: 0.1
title:Red Hat: Critical: samba security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220457 - Security Advisory
Trust: 0.1
title:Red Hat: Critical: samba security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220329 - Security Advisory
Trust: 0.1
title:Red Hat: Critical: samba security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220664 - Security Advisory
Trust: 0.1
title:Red Hat: Critical: samba security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220458 - Security Advisory
Trust: 0.1
title:Red Hat: Critical: samba security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220663 - Security Advisory
Trust: 0.1
title:Red Hat: Critical: samba security and bug fix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220328 - Security Advisory
Trust: 0.1
title:Red Hat: Critical: samba security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220330 - Security Advisory
Trust: 0.1
title:Debian CVElist Bug Report Logs: samba: CVE-2021-44142url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=a2808bd91ead4fb4ad90e6c138690723
Trust: 0.1
title:Ubuntu Security Notice: USN-5260-1: Samba vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-5260-1
Trust: 0.1
title:Debian Security Advisories: DSA-5071-1 samba -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=966a313ce95b33748fba988c48abb6d6
Trust: 0.1
title:Amazon Linux 2: ALAS2-2022-1746url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2022-1746
Trust: 0.1
title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2021-44142
Trust: 0.1
title:Amazon Linux AMI: ALAS-2022-1564url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2022-1564
Trust: 0.1
title:Amazon Linux 2022: ALAS-2022-224url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2022&qid=ALAS-2022-224
Trust: 0.1
title:Amazon Linux 2022: ALAS2022-2022-022url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2022&qid=ALAS2022-2022-022
Trust: 0.1
title:CVE-2021-44142 Vulnerability Checkerurl:https://github.com/horizon3ai/CVE-2021-44142 
Trust: 0.1
title:CVE-2021-44142 Vulnerability Checkerurl:https://github.com/hrsman/Samba-CVE-2021-44142 
Trust: 0.1
title:CVE-2021-44142 Storytaleurl:https://github.com/gudyrmik/CVE-2021-44142 
Trust: 0.1
title:CVE-2020-0609
CVE-2020-0796
CVE-2021-44142
CVE-2022-41040
CVE-2022-47966 Scannerurl:https://github.com/stalker3343/diplom 
Trust: 0.1
title:Repository with scripts to verify system against CVEurl:https://github.com/backloop-biz/Vulnerability_checker 
Trust: 0.1
title:Repository with scripts to verify system against CVEurl:https://github.com/backloop-biz/CVE_checks 
Trust: 0.1
title:Threatposturl:https://threatpost.com/samba-fruit-bug-rce-root-access/178141/
Trust: 0.1
title:The Registerurl:https://www.theregister.co.uk/2022/02/02/samba_vfs_fruit_vulnerability/
Trust: 0.1
sources:
            
            
            ZDI: ZDI-22-246 // 
            
            
            
            ZDI: ZDI-22-245 // 
            
            
            
            ZDI: ZDI-22-244 // 
            
            
            
            VULMON: CVE-2021-44142 // 
            
            
            
            JVNDB: JVNDB-2022-001296 // 
            
            
            
            CNNVD: CNNVD-202201-2719

EXTERNAL IDS
db:NVDid:CVE-2021-44142
Trust: 6.0
db:CERT/CCid:VU#119678
Trust: 3.4
db:ZDIid:ZDI-22-246
Trust: 1.3
db:ZDIid:ZDI-22-244
Trust: 0.8
db:PACKETSTORMid:166137
Trust: 0.8
db:JVNid:JVNVU92602689
Trust: 0.8
db:JVNDBid:JVNDB-2022-001296
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-15846
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-15833
Trust: 0.7
db:ZDIid:ZDI-22-245
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-16156
Trust: 0.7
db:PACKETSTORMid:165906
Trust: 0.7
db:PACKETSTORMid:165842
Trust: 0.7
db:CS-HELPid:SB2022032506
Trust: 0.6
db:CS-HELPid:SB2022021713
Trust: 0.6
db:CS-HELPid:SB2022041954
Trust: 0.6
db:CS-HELPid:SB2022021902
Trust: 0.6
db:CS-HELPid:SB2022021417
Trust: 0.6
db:CS-HELPid:SB2022051734
Trust: 0.6
db:CS-HELPid:SB2022020807
Trust: 0.6
db:CS-HELPid:SB2022022408
Trust: 0.6
db:PACKETSTORMid:169234
Trust: 0.6
db:AUSCERTid:ESB-2022.0489
Trust: 0.6
db:AUSCERTid:ESB-2022.0795
Trust: 0.6
db:AUSCERTid:ESB-2022.0600
Trust: 0.6
db:AUSCERTid:ESB-2022.0619
Trust: 0.6
db:CNNVDid:CNNVD-202201-2719
Trust: 0.6
db:PACKETSTORMid:165793
Trust: 0.2
db:PACKETSTORMid:165791
Trust: 0.2
db:PACKETSTORMid:165789
Trust: 0.2
db:PACKETSTORMid:165801
Trust: 0.2
db:PACKETSTORMid:166138
Trust: 0.1
db:PACKETSTORMid:165796
Trust: 0.1
db:PACKETSTORMid:165788
Trust: 0.1
db:PACKETSTORMid:165797
Trust: 0.1
db:PACKETSTORMid:165790
Trust: 0.1
db:PACKETSTORMid:165905
Trust: 0.1
db:VULHUBid:VHN-406753
Trust: 0.1
db:VULMONid:CVE-2021-44142
Trust: 0.1
sources:
            
            
            CERT/CC: VU#119678 // 
            
            
            
            ZDI: ZDI-22-246 // 
            
            
            
            ZDI: ZDI-22-245 // 
            
            
            
            ZDI: ZDI-22-244 // 
            
            
            
            VULHUB: VHN-406753 // 
            
            
            
            VULMON: CVE-2021-44142 // 
            
            
            
            JVNDB: JVNDB-2022-001296 // 
            
            
            
            PACKETSTORM: 165801 // 
            
            
            
            PACKETSTORM: 166137 // 
            
            
            
            PACKETSTORM: 165793 // 
            
            
            
            PACKETSTORM: 165791 // 
            
            
            
            PACKETSTORM: 165789 // 
            
            
            
            CNNVD: CNNVD-202201-2719 // 
            
            
            
            NVD: CVE-2021-44142

REFERENCES
url:https://www.samba.org/samba/security/cve-2021-44142.html
Trust: 4.0
url:https://kb.cert.org/vuls/id/119678
Trust: 2.6
url:https://bugzilla.samba.org/show_bug.cgi?id=14914
Trust: 1.8
url:https://www.zerodayinitiative.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin
Trust: 1.8
url:https://security.gentoo.org/glsa/202309-06
Trust: 1.1
url:https://access.redhat.com/security/cve/cve-2021-44142
Trust: 1.0
url:https://www.kb.cert.org/vuls/id/119678
Trust: 1.0
url:cve-2021-44142  
Trust: 0.8
url:https://jvn.jp/vu/jvnvu92602689/
Trust: 0.8
url:https://www.cybersecurity-help.cz/vdb/sb2022051734
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0795
Trust: 0.6
url:https://vigilance.fr/vulnerability/samba-buffer-overflow-via-vfs-module-vfs-fruit-37416
Trust: 0.6
url:https://www.zerodayinitiative.com/advisories/zdi-22-246/
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022032506
Trust: 0.6
url:https://packetstormsecurity.com/files/169234/debian-security-advisory-5071-1.html
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022021713
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022021417
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022041954
Trust: 0.6
url:https://packetstormsecurity.com/files/165842/ubuntu-security-notice-usn-5260-3.html
Trust: 0.6
url:https://packetstormsecurity.com/files/165906/red-hat-security-advisory-2022-0457-03.html
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022020807
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0619
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022021902
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2021-44142/
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022022408
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0600
Trust: 0.6
url:https://packetstormsecurity.com/files/166137/red-hat-security-advisory-2022-0664-01.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0489
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2021-44142
Trust: 0.5
url:https://access.redhat.com/security/team/contact/
Trust: 0.4
url:https://listman.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.4
url:https://bugzilla.redhat.com/):
Trust: 0.4
url:https://access.redhat.com/security/team/key/
Trust: 0.4
url:https://access.redhat.com/security/updates/classification/#critical
Trust: 0.4
url:https://access.redhat.com/articles/11258
Trust: 0.4
url:https://cwe.mitre.org/data/definitions/125.html
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/787.html
Trust: 0.1
url:https://github.com/horizon3ai/cve-2021-44142
Trust: 0.1
url:https://ubuntu.com/security/notices/usn-5260-2
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.zerodayinitiative.com/advisories/zdi-22-244/
Trust: 0.1
url:https://www.samba.org/samba/security/
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:0664
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:0331
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:0330
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:0329
Trust: 0.1
sources:
            
            
            CERT/CC: VU#119678 // 
            
            
            
            ZDI: ZDI-22-246 // 
            
            
            
            ZDI: ZDI-22-245 // 
            
            
            
            ZDI: ZDI-22-244 // 
            
            
            
            VULHUB: VHN-406753 // 
            
            
            
            VULMON: CVE-2021-44142 // 
            
            
            
            JVNDB: JVNDB-2022-001296 // 
            
            
            
            PACKETSTORM: 165801 // 
            
            
            
            PACKETSTORM: 166137 // 
            
            
            
            PACKETSTORM: 165793 // 
            
            
            
            PACKETSTORM: 165791 // 
            
            
            
            PACKETSTORM: 165789 // 
            
            
            
            CNNVD: CNNVD-202201-2719 // 
            
            
            
            NVD: CVE-2021-44142

CREDITS
Nguyen Hoang Thach (https://twitter.com/hi_im_d4rkn3ss) and Billy Jheng Bing-Jhong (https://twitter.com/st424204)
Trust: 2.0
sources:
            
            
            ZDI: ZDI-22-246 // 
            
            
            
            ZDI: ZDI-22-245 // 
            
            
            
            CNNVD: CNNVD-202201-2719

SOURCES
db:CERT/CCid:VU#119678
db:ZDIid:ZDI-22-246
db:ZDIid:ZDI-22-245
db:ZDIid:ZDI-22-244
db:VULHUBid:VHN-406753
db:VULMONid:CVE-2021-44142
db:JVNDBid:JVNDB-2022-001296
db:PACKETSTORMid:165801
db:PACKETSTORMid:166137
db:PACKETSTORMid:165793
db:PACKETSTORMid:165791
db:PACKETSTORMid:165789
db:CNNVDid:CNNVD-202201-2719
db:NVDid:CVE-2021-44142

LAST UPDATE DATE
2025-03-03T20:05:32.803000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#119678date:2022-06-27T00:00:00
db:ZDIid:ZDI-22-246date:2022-02-01T00:00:00
db:ZDIid:ZDI-22-245date:2022-02-01T00:00:00
db:ZDIid:ZDI-22-244date:2022-02-01T00:00:00
db:VULHUBid:VHN-406753date:2022-02-23T00:00:00
db:VULMONid:CVE-2021-44142date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2022-001296date:2022-02-02T02:33:00
db:CNNVDid:CNNVD-202201-2719date:2022-12-09T00:00:00
db:NVDid:CVE-2021-44142date:2024-11-21T06:30:25.637

SOURCES RELEASE DATE
db:CERT/CCid:VU#119678date:2022-01-31T00:00:00
db:ZDIid:ZDI-22-246date:2022-02-01T00:00:00
db:ZDIid:ZDI-22-245date:2022-02-01T00:00:00
db:ZDIid:ZDI-22-244date:2022-02-01T00:00:00
db:VULHUBid:VHN-406753date:2022-02-21T00:00:00
db:VULMONid:CVE-2021-44142date:2022-02-21T00:00:00
db:JVNDBid:JVNDB-2022-001296date:2022-02-02T00:00:00
db:PACKETSTORMid:165801date:2022-02-02T16:21:28
db:PACKETSTORMid:166137date:2022-02-24T16:10:57
db:PACKETSTORMid:165793date:2022-02-01T17:02:58
db:PACKETSTORMid:165791date:2022-02-01T17:02:44
db:PACKETSTORMid:165789date:2022-02-01T17:00:19
db:CNNVDid:CNNVD-202201-2719date:2022-01-31T00:00:00
db:NVDid:CVE-2021-44142date:2022-02-21T15:15:07.380