CVE-2019-3880
MEDIUM severity · CVSS 5.4 · Path traversal
5.4CVSS MEDIUM
Summary
A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
Confidentiality impactNone
Integrity impactLow
Availability impactLow
Exploit probability (EPSS)3%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.html ↗
Additional information
- NVD record
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.htmlPatch
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3880Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00106.htmlAdvisory
- https://access.redhat.com/errata/RHSA-2019:1966Advisory
- https://access.redhat.com/errata/RHSA-2019:1967Advisory
- https://access.redhat.com/errata/RHSA-2019:2099Advisory
- https://access.redhat.com/errata/RHSA-2019:3582Advisory
- https://lists.debian.org/debian-lts-announce/2019/04/msg00013.htmlAdvisory