Description
The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.6-1 | — |
| Debian 13 | samba | 3.0.6-1 | — |
| Debian 12 | samba | 3.0.6-1 | — |
| Debian 3.0 | samba | 2.2.3a-14.1 | DSA-600-1 |
Advisories 1
- DSA-600-1 samba - arbitrary file access Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://us4.samba.org/samba/news/#security_2.2.12
- 200529 vendor-advisory
- 20040930 Samba Security Announcement -- Potential Arbitrary File Access mailing-list
- FLSA:2102 vendor-advisory
- 20040930 Samba Arbitrary File Access Vulnerability third-party-advisory
- 20041005 ERRATA: Potential Arbitrary File Access (CAN-2004-0815) mailing-list
- DSA-600 vendor-advisory
- RHSA-2004:498 vendor-advisory
- CLA-2004:873 vendor-advisory
- 11281 vdb-entry
- MDKSA-2004:104 vendor-advisory
- 2004-0051 vendor-advisory
- 57664 vendor-advisory
- 101584 vendor-advisory
- SUSE-SA:2004:035 vendor-advisory
- samba-file-access(17556) vdb-entry