Samba Symlink Race Vulnerability (CVE-2021-20316)

# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.147401");
  script_version("2026-04-17T15:51:27+0000");
  script_tag(name:"last_modification", value:"2026-04-17 15:51:27 +0000 (Fri, 17 Apr 2026)");
  script_tag(name:"creation_date", value:"2022-01-12 02:22:26 +0000 (Wed, 12 Jan 2022)");
  script_tag(name:"cvss_base", value:"6.6");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:H/Au:S/C:C/I:C/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2022-08-26 18:05:00 +0000 (Fri, 26 Aug 2022)");

  script_cve_id("CVE-2021-20316");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba Symlink Race Vulnerability (CVE-2021-20316)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2022 Greenbone AG");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Samba is prone to a symlink race vulnerability which can allow
  metadata read and modify outside of the exported share.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"A malicious client can use a symlink race to access or modify
  file or directory metadata information outside of the exported share. The user must have
  permissions to read or write the metadata on the accessed file or directory.");

  script_tag(name:"affected", value:"Samba prior to version 4.15.0.");

  script_tag(name:"solution", value:"Update to version 4.15.0 or later.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.15.0.html");
  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2021-20316.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "4.15.0")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.15.0", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);