FreeBSD smbfs directory traversal
| freebsd-smbfs-directory-traversal (26860) |  Low Risk |
Description:
FreeBSD could allow a remote attacker to traverse directories on the system, caused by improper validation by smbfs. A remote attacker with a valid user account could send a specially-crafted command containing "dot dot backslash" sequences (..\) in the directory name to traverse directories and access files and directories outside of the smbfs mounted file system.
Consequences:
Obtain Information
Remedy:
Refer to FreeBSD Security Advisory FreeBSD-SA-06:16 for patch, upgrade, or suggested workaround information. See References.
References:
- FreeBSD Security Advisory FreeBSD-SA-06:16.smbfs: smbfs chroot escape.
- BID-18202: FreeBSD SMBFS CHRoot Security Restriction Bypass Vulnerability
- CVE-2006-2654: Directory traversal vulnerability in smbfs smbfs on FreeBSD 4.10 up to 6.1 allows local users to escape chroot restrictions for an SMB-mounted filesystem via ..\\ sequences. NOTE: this is similar to CVE-2006-1864, but this is a different implementation of smbfs, so it has a different CVE identifier.
- OSVDB ID: 25851: FreeBSD SMBFS Traversal chroot Bypass
- SA20390: FreeBSD SMBFS chroot Directory Traversal Vulnerability
- SECTRACK ID: 1016194: FreeBSD smbfs `..\` Input Validation Hole Lets Users Traverse the Directory
Platforms Affected:
- FreeBSD FreeBSD
Reported:
May 31, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net