CVE-2023-4091

{"id": "CVE-2023-4091", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-11-03T08:15:08.197", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:6209", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:6744", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7371", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7408", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7464", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7467", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4091", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241882", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.samba.org/show_bug.cgi?id=15439", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html", "source": "secalert@redhat.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZUMVALLFFDFC53JZMUWA6HPD7HUGAP5I/", "tags": ["Mailing List"], "source": "secalert@redhat.com"}, {"url": "https://security.netapp.com/advisory/ntap-20231124-0002/", "source": "secalert@redhat.com"}, {"url": "https://www.samba.org/samba/security/CVE-2023-4091.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module \"acl_xattr\" is configured with \"acl_xattr:ignore system acls = yes\". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad en Samba, donde la falla permite a los clientes SMB truncar archivos, incluso con permisos de solo lectura cuando el m\u00f3dulo Samba VFS \"acl_xattr\" est\u00e1 configurado con \"acl_xattr:ignore system acls = yes\". El protocolo SMB permite abrir archivos cuando el cliente solicita acceso de solo lectura, pero luego trunca impl\u00edcitamente el archivo abierto a 0 bytes si el cliente especifica una solicitud de disposici\u00f3n de creaci\u00f3n de SOBRESCRITURA separada. El problema surge en configuraciones que omiten las comprobaciones de permisos del sistema de archivos del kernel y dependen \u00fanicamente de los permisos de Samba."}], "lastModified": "2024-04-22T16:15:13.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C9913F9-D46D-4CE3-AA78-E50D32779971", "versionEndExcluding": "4.17.12"}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A33312F-1523-4647-83DA-6DD6231906F9", "versionEndExcluding": "4.18.8", "versionStartIncluding": "4.18.0"}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE496104-DDB5-4709-8026-C83E99B0C865", "versionEndExcluding": "4.19.1", "versionStartIncluding": "4.19.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:storage:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "379A5883-F6DF-41F5-9403-8D17F6605737"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DDA3E5A-8754-4C48-9A27-E2415F8A6000"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}