QwikSec

Security Database

CVE

CWE

Training

CVE-2019-3870

Published: Apr 9, 2019

Modified: Aug 4, 2024

PUBLISHED

CVSS v3.0

6.1

MEDIUM

Description

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Vendor	Product	Versions
The Samba Project	samba	affected `4.9.6` affected `4.10.2`

Weaknesses (CWE)

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

References

FEDORA-2019-cacf88eabf

vendor-advisory

x_refsource_FEDORA

FEDORA-2019-db21b5f1d2

vendor-advisory

x_refsource_FEDORA

https://www.samba.org/samba/security/CVE-2019-3870.html

x_refsource_MISC

https://bugzilla.samba.org/show_bug.cgi?id=13834

x_refsource_MISC

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3870

x_refsource_CONFIRM

https://www.synology.com/security/advisory/Synology_SA_19_15

x_refsource_CONFIRM

https://support.f5.com/csp/article/K20804356

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.