Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1095
_____________________________________________________________________

DATE                : 28/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Samba versions prior to 4.25.1.

====================================================================
https://www.samba.org/samba/security/CVE-2026-109411.html
_____________________________________________________________________
 
CVE-2026-109411.html:

===========================================================
== Subject:     Access control bypass via vfs_ceph_rgw case-insensitive open
==
== CVE ID#:     2026-109411
==
== Versions:    All versions since 4.25 where vfs_ceph_rgw is present
==
== Summary:     A differently cased open of a file owned by another user can
==              bypass access checks on Ceph RGW shares, allowing that user's
==              files to be read or overwritten.
===========================================================


===========
Description
===========

On shares using the vfs_ceph_rgw module, the module's openat()
implementation ignored the (possibly case-corrected) filename supplied
by the file server and instead re-opened the name originally sent by
the client.

When a client opened an existing file using a different case than it exists
on disk with a create disposition of FILE_OPEN_IF, the case-insensitive
lookup failed inside the module. The file server then treated the request
as a file creation, checking only the caller's permission to add a file to
the parent directory and skipping the access check on the existing object.
The subsequent open then collided with, and re-opened, the existing object.

As a result an authenticated user could read or overwrite files owned
by another user, despite those files having restrictive permissions.

==================
Patch Availability
==================

Patches addressing this issue have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba 4.25.1 have been issued to correct the defect. Samba
administrators are advised to upgrade to these releases or apply the
patch as soon as possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1)

==========
Workaround
==========

Only shares configured with the vfs_ceph_rgw module are affected. If
you are not sure, look for the string "ceph_rgw" in your smb.conf. If
there is a line like this

    vfs objects = ceph_rgw

the share is affected.

Setting

    case sensitive = yes

on affected shares avoids the vulnerability, because the differently-
cased name is then treated as a distinct object rather than resolving
to the existing file. Note this changes share behaviour for clients
that rely on case-insensitive name handling.

=======
Credits
=======

Originally reported by hataehoon.

Patches provided by Vinit Agnihotri of IBM and Anoop C S of IBM and
the Samba team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================