Description
The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cifs-utils | 2:5.1-1 | — |
| Debian 14 | samba | 2:3.4.7~dfsg-2 | — |
| Debian 13 | cifs-utils | 2:5.1-1 | — |
| Debian 13 | samba | 2:3.4.7~dfsg-2 | — |
| Debian 12 | cifs-utils | 2:5.1-1 | — |
| Debian 12 | samba | 2:3.4.7~dfsg-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | cifs-utils | 4.8.1-2.el6_1.2 | RHSA-2011:1221 |
| RHEL 6 | samba +11 | 3.5.6-86.el6_1.4 | RHSA-2011:1221 |
| RHEL 5 | samba3x +7 | 3.5.4-0.83.el5_7.2 | RHSA-2011:1220 |
Advisories 2
- RHSA-2011:1221 Red Hat Security Advisory: samba and cifs-utils security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1220 Red Hat Security Advisory: samba3x security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- http://git.samba.org/?p=cifs-utils.git%3Ba=commit%3Bh=1e7a32924b22d1f786b6f490ce8590656f578f91
- RHSA-2011:1220 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=726691
- 45798 third-party-advisory
- 1025984 vdb-entry
- [oss-security] 20110729 CVE-2011-2724 assignment notification -- samba -- incomplete fix for CVE-2010-0547 issue mailing-list
- MDVSA-2011:148 vendor-advisory
- http://comments.gmane.org/gmane.linux.kernel.cifs/3827
- RHSA-2011:1221 vendor-advisory