Andrew Tridgell

**Name of the Vulnerable Software and Affected Versions** acl versions prior to 2.4.0 **Description** A symlink traversal issue exists in pathname-based functions. Local attackers can escalate privileges by replacing a pathname component with a symbolic link. If an attacker controls any part of a pathname processed by a privileged caller, they can redirect ACL read or write operations to arbitrary files or directories, allowing unauthorized manipulation of access control lists. The affected functions are `acl get file()`, `acl set file()`, `acl extended file()`, and `acl delete def file()`. **Recommendations** Update to version 2.4.0 or later. As a temporary mitigation, restrict access to the functions `acl get file()`, `acl set file()`, `acl extended file()`, and `acl delete def file()` to prevent unauthorized pathname manipulation.

**Name of the Vulnerable Software and Affected Versions** acl versions prior to 2.4.0 **Description** A time-of-check to time-of-use (TOCTOU) race condition occurs when a local attacker replaces a pathname component with a symbolic link between an `lstat()` check and subsequent symlink-following operations. These operations include `stat()`, `chown()`, `chmod()`, `acl get file()`, and `acl set file()`. If a privileged process invokes `getfacl`, `setfacl`, or `chacl` over a path controlled by the attacker, file access control list operations can be redirected to arbitrary files, leading to local privilege escalation. **Recommendations** Update to version 2.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** attr versions prior to 2.6.0 **Description** A flaw in the `attr` component, specifically within the `getfattr` and `setfattr` utilities, allows a local attacker to perform a symlink traversal attack. By replacing a pathname component with a symbolic link during directory hierarchy traversal, an attacker can redirect operations to arbitrary files. This leads to local privilege escalation when these utilities are executed by a privileged process over a path controlled by the attacker. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.4.3 **Description** A symlink race condition exists in path-based system calls, including `chmod()`, `lchown()`, `utimes()`, `rename()`, `unlink()`, `mkdir()`, `symlink()`, `mknod()`, `link()`, `rmdir()`, and `lstat()`. Local attackers with filesystem access can exploit the timing window between path resolution and system call execution by swapping symlinks. This allows the redirection of operations to files outside the exported rsync module, enabling the application of sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files. This issue affects rsync daemons configured with `use chroot = no`. **Recommendations** Update to version 3.4.3 or later. Configure rsync daemons to use `use chroot = yes` to prevent access outside the module boundary.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to a buffer overflow in the SMB capability, which can be exploited by remote attackers. This can lead to a denial of service and potentially allow the execution of arbitrary code. The attack is carried out via an SMB packet that specifies a smaller buffer length than is required. Recommendations: For Microsoft Windows XP, 2000, and NT, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.