PT-2019-4621 · Samba+5 · Samba+5

Publicado 2019-04-08 · Atualizado 2024-06-15 · CVE-2019-3880

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Samba versions prior to 4.8.11 Samba versions prior to 4.9.6 Samba versions prior to 4.10.2

Description A flaw was found in the way Samba implemented an RPC endpoint emulating the Windows registry service API. This issue allows an unprivileged attacker to create a new registry hive file anywhere they have Unix permissions, potentially leading to the creation of a new file in the Samba share. The vulnerability is related to a path traversal issue, enabling attackers to write or detect files outside the Samba share, which could impact data integrity and confidentiality.

Recommendations For versions prior to 4.8.11, update to version 4.8.11 or later. For versions prior to 4.9.6, update to version 4.9.6 or later. For versions prior to 4.10.2, update to version 4.10.2 or later.

Correção

DoS

XSS

Path traversal

Enumeração de Fraquezas

CWE-79

CWE-22

Identificadores relacionados

ALT-PU-2019-1638

BDU:2020-00765

BDU:2020-00766

CESA-2019_2099

CESA-2019_3582

CVE-2019-3880

DLA-1754-1

DSA-4427-1

ECHO-5D38-846C-F790

OPENSUSE-SU-2019:1180-1

OPENSUSE-SU-2019_1180-1

OPENSUSE-SU-2019_1292-1

OPENSUSE-SU-2024:11365-1

RHSA-2019:1966

RHSA-2019:1967

RHSA-2019:2099

RHSA-2019:3582

RHSA-2019_2099

RHSA-2019_3582

SUSE-SU-2019:1037-1

SUSE-SU-2019:1040-1

SUSE-SU-2019:1194-1

SUSE-SU-2019:1195-1

SUSE-SU-2019:1203-1

SUSE-SU-2019:14042-1

SUSE-SU-2019_1037-1

SUSE-SU-2019_1040-1

SUSE-SU-2019_1194-1

SUSE-SU-2019_1195-1

SUSE-SU-2019_1203-1

SUSE-SU-2019_14042-1

USN-3939-1

USN-3939-2

Produtos afetados

Alt Linux

Centos

Red Hat

Samba

Suse

Ubuntu

Referências · 140

• https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e8137c52b · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRLRO7BPRFETVFZ4TVJL2VFZEPHKJY4 · Aviso do Fabricante
• https://bugzilla.suse.com/1099590 · Nota
• https://suse.com/security/cve/CVE-2019-12436 · Nota
• https://suse.com/security/cve/CVE-2018-16851 · Nota
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1050 · Nota
• https://suse.com/security/cve/CVE-2021-20254 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:1195-1 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-3880 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-7494 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-3880 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2019-2099.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2008-1105 · Nota