All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled or the share also available via NFS in order for this attack to succeed.

🗓️ 15 Oct 2024 07:00:00Reported by MicrosoftType

Samba before 4.13.16 allows a race via server message block or network file system to create a directory outside the share.

Reporter	Title	Published	Views	Family All 96
IBM Security Bulletins	Security Bulletin: IBM i is vulnerable to bypass security restrictions due to Samba SMB1 (CVE-2021-43566 and CVE-2021-44141)	2 Mar 202214:24	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2021-43566)	27 Apr 202211:10	–	ibm
FreeBSD	samba -- Multiple Vulnerabilities	31 Jan 202200:00	–	freebsd
ATTACKERKB	CVE-2021-43566	11 Jan 202216:15	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-032)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : samba, --advisory ALAS2-2025-2979 (ALAS-2025-2979)	4 Sep 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: samba (CVE-2021-43566)	22 Jan 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : samba (EulerOS-SA-2022-1438)	18 Apr 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : samba (EulerOS-SA-2022-1459)	18 Apr 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : samba (EulerOS-SA-2022-1586)	25 Apr 202200:00	–	nessus