Samba Patches Critical Remote Code Execution Vulnerability – CVE-2021-44142

Share :

Background

On Monday, January 31, 2022, Samba released an advisory for remote code execution vulnerability CVE-2021-44142. All versions of Samba prior to 4.13.17 are vulnerable to CVE-2021-44142. The vulnerability was disclosed as part of the Pwn2Own Austin competition where researchers are challenged to exploit widely-used software and devices with unknown vulnerabilities. It was disclosed to Samba by security researcher Orange Tsai from security firm DEVCORE.

CVE ID

CVSS Score V3

CVSS Criticality

Type

Description

CVE-2021-44142

Initially 9.9 downgraded to 8.8 later

Initially, Critical downgraded to High

Out-of-bounds Write

& Out-of-bounds Read

Samba vfs_fruit module out-of-bounds heap read and write

Analysis

CVE-2021- 44142

This vulnerability has a CVSS score of 9.9 (later downgraded to 8.8) and is an out-of-bounds heap read/write vulnerability in Samba’s VFS module “vfs_fruit” that if successfully exploited, could allow remote attacks to execute arbitrary code with root privileges on the affected system.

Solutions and Recommendations

Arctic Wolf advises Samba administrators to upgrade to the most recent releases or apply the patch as soon as possible to mitigate any potential attacks exploiting the vulnerability. Although the 3 versions listed below are not vulnerable to code execution vulnerability, Arctic Wolf recommends upgrading to the most recent version supported within your environment.

Affected Samba Versions: All versions of Samba prior to 4.13.17 that are NOT 4.14.12 or 4.15.5 and use the VFS “fruit” module with default values for VFS objects in the smb.conf file.

Fixed Samba Versions:

References

Learn more about Arctic Wolf’s Managed Risk solution or request a demo today.

Sule Tatar

Sule Tatar

Sule Tatar is a Product Marketing Manager at Arctic Wolf, where she does research on security trends and brings groundbreaking cybersecurity products and services to market. She has extensive experience in the B2B cybersecurity space and holds a bachelor's degree in computer engineering and an MBA.
Share :
Table of Contents
Categories
Subscribe to our Monthly Newsletter