Medium severity · published Apr 9, 2019
CVE-2019-3870
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Directory Server · Synology
All versions, or not specified · source: NVD
DM
Diskstation Manager · Synology
5.2; 6.1; 6.2 · source: NVD
FE
Fedora · Fedoraproject
29; 30 · source: NVD
RM
Router Manager · Synology
1.2 · source: NVD
SA
Samba · Samba
4.9.0 before 4.9.6; 4.10.0 before 4.10.2 · source: NVD
SF
Skynas Firmware · Synology
All versions, or not specified · source: NVD
VF
Vs960hd Firmware · Synology
before 2.3.6-1720 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3870
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3870
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3870
Exploit
https://bugzilla.samba.org/show_bug.cgi?id=13834
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6354GALK73CZWQKFUG7AWB6EIEGFMF62/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTJVFA3RZ6G2IZDTVKLHRMX6QBYA4GPA/
Third Party Advisory
https://support.f5.com/csp/article/K20804356
Mitigation
https://www.samba.org/samba/security/CVE-2019-3870.html
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)