CVE-2023-3961
published 2023-11-03CVE-2023-3961: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.41%
82.3th percentile
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.17.12+dfsg-0+deb12u1 (bookworm) | samba 2:4.17.12+dfsg-0+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| paloalto | pan-os | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | storage | — | — |
| samba | samba | < 4.17.12 | 4.17.12 |
| samba | samba | >= 0 < 2:4.17.12+dfsg-0+deb12u1 | 2:4.17.12+dfsg-0+deb12u1 |
| samba | samba | >= 0 < 2:4.19.1+dfsg-1 | 2:4.19.1+dfsg-1 |
| samba | samba | >= 0 < 2:4.19.1+dfsg-1 | 2:4.19.1+dfsg-1 |
| samba | samba | >= 4.18.0 < 4.18.8 | 4.18.8 |
| samba | samba | >= 4.19.0 < 4.19.1 | 4.19.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor SMB pipe name requests containing directory traversal sequences (../) targeting Unix domain socket paths outside the Samba private directory ↗
- →Alert on smbd processes connecting as root to Unix domain sockets located outside the expected private directory ↗
- →Inspect SMB RPC pipe name fields (e.g. in SAMR, LSA, SPOOLSS bind requests) for path traversal patterns that resolve outside the private socket directory ↗
- →Watch for unexpected connections to arbitrary Unix domain sockets on the filesystem initiated by smbd running as root, which may indicate exploitation of this path traversal ↗
- ·Red Hat Enterprise Linux 6 (samba and samba4) and RHEL 7 (samba) are confirmed NOT affected; only specific versions require patching ↗
- ·No mitigation is available from Red Hat; patching is the only remediation path ↗
- ·The vulnerability is exploitable remotely over SMB (CVSS 9.8), making network-exposed Samba instances highest priority for patching ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_debian9.1CRITICAL
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Samba) — CVE-2023-3961
vendor_oracle·2025-01-15·CVSS 9.8
CVE-2023-3961 [CRITICAL] Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Samba) — CVE-2023-3961
Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Samba) vulnerability
CVE: CVE-2023-3961
CVSS: 9.8
Protocol: SMB
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Red Hat
samba: smbd allows client access to unix domain sockets on the file system as root
vendor_redhat·2023-10-10·CVSS 9.1
CVE-2023-3961 [CRITICAL] CWE-22 samba: smbd allows client access to unix domain sockets on the file system as root
samba: smbd allows client access to unix domain sockets on the file system as root
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could poten
Debian
CVE-2023-3961: samba - A path traversal vulnerability was identified in Samba when processing client pi...
vendor_debian·2023·CVSS 9.1
CVE-2023-3961 [CRITICAL] CVE-2023-3961: samba - A path traversal vulnerability was identified in Samba when processing client pi...
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events,
GHSA
GHSA-8m6h-6qw7-f6cg: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
ghsa_unreviewed·2023-11-03
CVE-2023-3961 [MEDIUM] CWE-22 GHSA-8m6h-6qw7-f6cg: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events,
OSV
CVE-2023-3961: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
osv·2023-11-03·CVSS 9.8
CVE-2023-3961 [CRITICAL] CVE-2023-3961: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events,
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications followed,
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications fol
https://access.redhat.com/errata/RHSA-2023:6209https://access.redhat.com/errata/RHSA-2023:6744https://access.redhat.com/errata/RHSA-2023:7371https://access.redhat.com/errata/RHSA-2023:7408https://access.redhat.com/errata/RHSA-2023:7464https://access.redhat.com/errata/RHSA-2023:7467https://access.redhat.com/security/cve/CVE-2023-3961https://bugzilla.redhat.com/show_bug.cgi?id=2241881https://bugzilla.samba.org/show_bug.cgi?id=15422https://www.samba.org/samba/security/CVE-2023-3961.htmlhttps://access.redhat.com/errata/RHSA-2023:6209https://access.redhat.com/errata/RHSA-2023:6744https://access.redhat.com/errata/RHSA-2023:7371https://access.redhat.com/errata/RHSA-2023:7408https://access.redhat.com/errata/RHSA-2023:7464https://access.redhat.com/errata/RHSA-2023:7467https://access.redhat.com/security/cve/CVE-2023-3961https://bugzilla.redhat.com/show_bug.cgi?id=2241881https://bugzilla.samba.org/show_bug.cgi?id=15422https://lists.fedoraproject.org/archives/list/[email protected]/message/ZUMVALLFFDFC53JZMUWA6HPD7HUGAP5I/https://security.netapp.com/advisory/ntap-20231124-0002/https://www.samba.org/samba/security/CVE-2023-3961.html
2023-11-03
Published