CVE-2021-43566

Name	CVE-2021-43566
Description	All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	1004691

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
samba (PTS)	buster, buster (security)	2:4.9.5+dfsg-5+deb10u3	vulnerable
	bullseye (security), bullseye	2:4.13.13+dfsg-1~deb11u5	fixed
	bookworm	2:4.17.5+dfsg-2	fixed
	sid	2:4.17.6+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
samba	source	experimental	2:4.16.0+dfsg-1
samba	source	bullseye	2:4.13.13+dfsg-1~deb11u4
samba	source	(unstable)	2:4.16.0+dfsg-2	1004691

Notes

[buster] - samba <ignored> (Minor issue; no backport to older versions, mitigations exists)
https://www.samba.org/samba/security/CVE-2021-43566.html
https://bugzilla.samba.org/show_bug.cgi?id=13979